# Crypto Kitchen

> CyberChef-style recipes: chain encodings, compression, hashes, AES, JWT and more, step by step. Write a recipe of operations, one per line, and run text or a file (up to 10 MB) through it: base64/32/58, hex, URL, HTML entities, Punycode and quoted-printable, gzip/deflate/brotli, hashes and HMAC, AES-GCM/CBC/CTR, XOR, ROT13/Caesar/Vigenère, JWT decode and verify, UUID/ULID parsing, timestamps, JSON, regex extraction, text case, byte swap, entropy and a Magic auto-decoder. Every intermediate result is shown; binary output can be downloaded.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://cryptokitchen.usefulweb.site/ (interactive tool at https://cryptokitchen.usefulweb.site/tool)
- JSON API: POST https://cryptokitchen.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://cryptokitchen.usefulweb.site/api/v1/tool)
- OpenAPI: https://cryptokitchen.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://cryptokitchen.usefulweb.site/mcp - tool `crypto_kitchen`

## Inputs
- input (textarea): Input
- inputFile (file): Or upload a file - Any file up to 10 MB, processed as raw bytes.
- inputEncoding (select): Pasted input is
- recipe (textarea): Recipe (one operation per line) - Syntax: op-id name=value name="value with spaces". Operations: to-base64, from-base64, to-base64url, to-base32, from-base32, to-base58, from-base58, to-hex (separator?), from-hex, to-hexdump, url-encode (all?), url-decode (plus?), html-encode (nonAscii?), html-decode, punycode-encode, punycode-decode, qp-encode, qp-decode, gzip (level?), gunzip, deflate, inflate, deflate-raw, inflate-raw, brotli-compress (quality?), brotli-decompress, hash (alg?, format?), hmac (alg?, key, format?), crc32, aes-encrypt (mode?, key, iv, aad?, padding?), aes-decrypt (mode?, key, iv, tag?, aad?, padding?), xor (key), rot13, caesar (shift?), vigenere-encode (key), vigenere-decode (key), jwt-decode, jwt-verify (key, alg?), uuid-parse, ulid-parse, timestamp (unit?), json-pretty (indent?, sortKeys?), json-minify, regex-extract (pattern, flags?, group?), text-case (mode?), reverse (unit?), byte-swap (width?), entropy, magic (depth?). Byte arguments accept hex:, b64: or utf8: prefixes. Use @key to insert the secret field.
- key (textarea): Secret / key (referenced as @key) - Optional: HMAC/JWT secret or a PEM/JWK public key for jwt-verify. Hidden in the results.
- outputFormat (select): Show output as

## Method
- The input (pasted text, hex, base64 or an uploaded file) becomes a byte string; each recipe line is an operation that maps bytes to bytes. Text operations decode as UTF-8. The table shows every intermediate result; on an error the pipeline stops and reports the failing step.
- Cryptography uses Node.js crypto (OpenSSL): AES-GCM appends/verifies the 16-byte tag, CBC uses PKCS#7 padding, CTR is a stream mode. You must supply key and IV, so results are reproducible; never reuse a GCM nonce with the same key.
- JWT decode never checks signatures. jwt-verify supports HS256/384/512 (secret), RS*/PS* (RSA), ES256/384/512 (raw r||s signatures as in RFC 7518) and EdDSA with a PEM, certificate or JWK key, and refuses tokens whose header alg differs from the expected one.
- Decompression stops at 50 MB of output to defuse decompression bombs; regex extraction runs in an isolated VM context with a 1-second limit.
- Magic checks for gzip/zlib headers, JWTs, UUIDs/ULIDs, timestamps, JSON, percent-encoding, HTML entities, hex, base64/base64url, base32 and quoted-printable, and applies the most plausible decoder repeatedly while the output stays readable or reveals another known format.

## Limits
- Data and keys are processed on the server for this request only. Do not paste production secrets.