CyberChef open source app statistics

CyberChef is a web app to carry out many cyber operations within a web browser. It has over 300 operations, including basic encoding with Base64, Advanced Encryption Standard (AES) decryption, or changing character encodings. The app can handle many operations at once, making it a quick way to experiment and translate data.

The CyberChef app:

• was created in an analyst’s 10% ‘innovation time’
• had its code fully opened in November 2016 under the Apache 2.0 license
• has been used in almost every country around the world
• has 75,000+ users per month
• has had 1.4 million unique users since its release
• has 75 open source community contributors

About GCHQ and CyberChef

GCHQ is the UK’s intelligence, security and cyber agency with a mission to help keep the UK safe. Its people use cutting-edge technology, technical ingenuity and world-leading partnerships to identify, analyse and disrupt threats in an increasingly complex world.

GCHQ believes that success depends on great minds not thinking alike. To promote innovation and personal development alongside their usual work, staff are encouraged to spend 10% of their hours on projects of their choosing related to their work. In 2014, an analyst began looking for open tools to help automate some data manipulation operations. It was too time consuming to write short scripts for every data transformation they needed such as encoding, encryption and viewing data in different formats.

Seeing few open source tools available, they began to develop what would later become known as CyberChef.

Understanding the CyberChef app’s design

The CyberChef web app has a simple design and includes:

• an input box to add the file or text you want to work with
• a list of all the operations you can run on the file or text
• a ‘recipe’ box where you can drag the operations you want to use and specify how you want to use them
• an output box to display the results of your operations

CyberChef is 100% client-side. No input or information about the combination of operations you use (known as ‘recipes’ in the app) is sent outside your browser.

GDS interviewed the anonymous creator of CyberChef, who said: “We understand that in the cybersecurity industry, people are often working on data that they want to keep to themselves due to commercial or personal sensitivities, so running all the processing locally is very important to us.”

CyberChef:

• is built in JavaScript
• uses webpack to generate bundles
• uses Grunt as a build system
• uses GitHub Actions for continuous integration
• is hosted with GitHub Pages
• uses ESLint for linting and has a test suite written by external contributors
• uses Nightwatch.js to test the user interface
• is also available via npm

Considering making CyberChef open source

After building the app for their own use, the creator began sharing CyberChef with:

• their colleagues in GCHQ
• other UK agencies and partners
• international government intelligence agencies

CyberChef became so well-used that other analysts started asking if the app could be shared more widely with industry, students, businesses, and anyone who wanted to try translating data. So the creator began to explore the possibility of opening CyberChef to the public.

Why GCHQ decided to open the code

The creator knew opening the CyberChef code would:

• provide a useful app for the wider industry
• help users to suggest bug fixes, contributions and ideas
• encourage others to experiment with data, encoding, encryption and computer science

GCHQ also wanted to be as transparent as it could while protecting operational secrets, encouraging interest in cyber security, and demonstrating its support of the open source community.

As its creator explained: “GCHQ has put a lot of effort into increasing transparency, so it makes sense that, where possible, we share apps like CyberChef, so everyone can use it. It helps to demystify what we’re doing a little and build trust.”

However, publicly releasing a cyber security app from a world-leading intelligence agency would require careful planning and execution. The creator knew they needed to:

• get appropriate approvals from GCHQ
• assess the possible risks of opening the app and its code
• mitigate any risks appropriately
• decide how to publish CyberChef’s code in the open
• agree how the app would be maintained and how they would manage contributions from non-GCHQ staff

Getting approval for CyberChef

CyberChef was not the first product GCHQ had released to the public. In 2015, the agency opened a graph database framework called Gaffer.

Knowing GCHQ had approved open code before, the creator began speaking with relevant teams such as the Innovation team and the Legal and Policy team to investigate what approvals were needed. The reaction was overwhelmingly supportive.

“To begin with I was really concerned about whether we would be able to make this an open source app due to the nature of our work, but I was put at ease by colleagues who made sure there was nothing sensitive being released,” says the CyberChef creator. After speaking with a few boards and departments to make sure they would not reveal anything sensitive, the creator moved to the technical process of opening the code.

Choosing a license

The creator wanted to make CyberChef a fully-fledged open source product, rather than simply publishing the code online. When releasing the app under an open source license, GCHQ would remain a major contributor. This meant they would manage control over all contributions and encourage people to use the app with appropriate credit given, but the app would not ‘belong’ to the organisation anymore.

GCHQ needed to choose an appropriate license to encourage the open source community to use and contribute to CyberChef while users had to give GCHQ credit where it was due. They chose Apache 2.0.

Some existing code language libraries were not compatible with Apache 2.0, but after a few changes and library substitutions, the code was ready to release.

Opening the code

When it came to publishing the code, the CyberChef creator chose GitHub as it was considered the industry standard for open source software hosting.

After getting the necessary sign-off, the creator:

1. Reviewed the code on GCHQ’s private networks to make sure it was presentable, readable, clear of any personal or sensitive data, and safe to release.
2. Tested the new open-friendly code on a device which had access to the public internet.
3. Practised some scenarios of contributing to and publishing the code in the open.
4. Published the code in a new repository on GitHub.

Maintaining anonymity

From working at GCHQ, the CyberChef creator needed to maintain anonymity but in a way which complemented open collaboration. They decided to use a string of random numbers as their username.

Deciding how to manage contributions

One of the main benefits of opening code is the ability to accept external contributions. Alongside the Apache 2.0 license, the creator published a contributor agreement. The GCHQ OSS Contributor License Agreement explains what constitutes a contribution, and the ownership and intellectual property rights of users when making a contribution to CyberChef.

CyberChef has received many interesting contributions. An example from early on in the project is how one contributor implemented a test suite for CyberChef’s operations. The CyberChef team still uses this test suite today.

CyberChef has a wiki with some code conventions and design principles for people contributing to the project. These code conventions and design principles are kept deliberately broad to avoid being too prescriptive, as the creator wants to minimise barriers for people contributing.

CyberChef maintains the right to refuse contributions but so far, the quality of contributions has been high. CyberChef has a linter and test suite built into the build process and if these flag contributions, people can usually fix the contributions themselves.

Managing CyberChef

GCHQ employees voluntarily manage the CyberChef app alongside their day-to-day work.

Managing reviews and version changes

For versioning, CyberChef uses semver for 3 different levels of changes.

1. Patch changes for bug fixes or small tweaks.
2. Minor changes for when CyberChef adds new features or operations.
3. Major changes for when CyberChef introduces a major new feature or restructure, for example the ‘Magic’ operation.

Communicating with users

GCHQ communicates with users of CyberChef by:

Impact of opening CyberChef

GCHQ has used CyberChef for educational and awareness programmes. For example, the competition CyberFirst Girls Competitions exists for year 8 schoolgirls to increase their awareness and interest in cybersecurity and computer science. It encourages participants to use CyberChef to solve some of the challenges in the competition.

Lessons learned in opening CyberChef

“Just go for it,” is CyberChef’s creator’s advice.

Managing and getting stakeholder buy-in was the biggest hurdle but once the creator received approval, they were able to set up an account and start publishing code. The open source community understands open source code is not always perfect and it’s up to the community to help improve it over time.

• UK Life Sciences Vision sets 10-year strategy for sector to build on successes of COVID-19 response and accelerate delivery of innovations to patients
• Mission-led approach to solve some of the biggest healthcare problems of our generation, including cancer and dementia
• Launch of Life Sciences Investment Programme brings total amount of funding available to UK’s most promising life sciences companies to £1bn

The remarkable response of the UK’s world class life sciences sector to COVID-19 will be used as a blueprint to accelerate the delivery of life-changing innovations to patients, as part of the government’s new UK Life Sciences Vision published today [Wednesday 7 July].

Today’s new UK Life Sciences Vision, co-developed with businesses and experts in the field, sets out a mission-led approach with bold ambition for the next decade to ensure scientific excellence, partnered with the dynamism of industry, is replicated to assist the NHS in solving the most pressing health challenges of our generation now and in the future.

The Vision outlines seven critical healthcare missions that government, industry, the NHS, academia and medical research charities will work together on at speed to solve – from cancer treatment to tackling dementia.

These missions will focus on preventing, diagnosing, monitoring and treating disease early, using innovative clinical trials to develop breakthrough products and treatments quickly to help save lives, and accelerating the development and adoption of new drugs, diagnostics, medical technology and digital tools.

The missions are:

• Accelerating the pace of studies into novel dementia treatment
• Enabling early diagnosis and treatments, including immune therapies such as cancer vaccines
• Sustaining the UK’s position in vaccine discovery, development and manufacturing
• Treatment and prevention of cardiovascular diseases and its major risk factors, including obesity
• Reducing mortality and morbidity from respiratory disease in the UK and globally
• Addressing the underlying biology of ageing
• Increasing the understanding of mental health conditions, including work to redefine diseases and develop tools to address them

Prime Minister Boris Johnson said:

We are indebted to the ingenuity of UK life sciences and its pioneers, with the discovery of the Oxford-AstraZeneca vaccine and the seamless collaboration between our scientists, industry, regulators and NHS saving millions of lives during the pandemic.

We must make sure this is the norm and use this new way of working to search for life-changing breakthroughs against diseases such as cancer, dementia and obesity, as we have done with Covid.

That’s why we are setting out our new Life Sciences Vision to bottle the formula we have developed to tackle Covid and improve health outcomes for patients across the board in the UK, and secure jobs and investment in the process as we build back better.

Business Secretary Kwasi Kwarteng said:

The UK life sciences sector has been a beacon of hope over the past year and a half, developing diagnostics and life-saving vaccines at remarkable speed to secure our route out of the pandemic.

This ambitious strategy sets out how we can replicate this same scientific excellence and agility to meet today’s greatest health challenges, doing with cancer, dementia and obesity what we did with this virus – gaining the upper hand with brilliant science.

Crucially, we’re going to build a pro-enterprise environment where our life sciences firms can access the finance to grow, are incentivised to onshore manufacturing, and can commercialise breakthrough products right here in the UK – rather than elsewhere – as we cement the UK’s position as a science superpower.

UK Government Minister for Scotland Iain Stewart said:

Scotland is home to world-leading life science and research expertise and this can only get stronger thanks to the launch of the UK Government’s Vision.

From the AstraZeneca vaccine, clinically trialled in Scotland, to Glasgow’s Lighthouse Lab processing over 10 million test samples from across the UK, the response to the pandemic from this sector demonstrates the collective strength of the Union.

Bringing together expertise from business, academia and the NHS, the Vision will uphold scientific collaboration and innovation, delivering real health benefits to patients across the country.

The UK’s life sciences sector has been at the centre of the country’s efforts to combat COVID-19 – from the development of the Oxford/AstraZeneca vaccine to the world leading RECOVERY trial identifying safe and effective therapeutics.

The Vision looks to emulate the successes of the UK Vaccines Taskforce– harnessing private sector expertise and removing unnecessary bureaucracy so that the UK’s most knowledgeable industry leaders can tackle future healthcare challenges at speed and at risk – with the aim of changing people’s lives for the better.

It will ensure that the UK benefits from new regulatory freedoms and opportunities now that we have left the European Union. The Medicines & Healthcare products Regulatory Agency (MHRA) will be able to act as an independent, sovereign regulator with great agility and with a focus on getting vaccines, drugs, and technologies to patients as safely and quickly as possible.

Addressing the most pressing healthcare challenges of our generation now and in the future will be an important part of the government’s levelling up agenda, helping to reduce health inequalities and improving out comes for patients in every corner of the UK.

Health and Social Care Secretary, Sajid Javid, said:

We have made immense strides in health research over the past year – the discovery of the use of dexamethasone and our vaccine rollout have been crucial to saving hundreds of thousands of lives and tackling COVID-19.

It’s crucial we continue to harness this enthusiasm and innovation, and map out a new route as we build back better. Today’s bold vision commits to putting the lessons we’ve learnt into action to transform the UK into a life sciences superpower.

Life Sciences Minister Nadhim Zahawi said:

Through this pandemic, we have turned to the brilliance of our UK life sciences sector which time after time has stepped up and done the country proud – from developing life-saving vaccines to identifying variants through world class genome sequencing.

We want to bottle up this scientific brilliance, and the Life Sciences Vision provides a roadmap for how we apply this innovation at the heart of our NHS helping to solve major health challenges such as dementia and obesity – all while ensuring the UK remains a global leader in life sciences.

The Life Sciences Vision is the first sectoral publication to build on the Plan for Growth, which sets out plans for the UK to stand as a world-leading centre for the development of brilliant ideas, innovation in industry, and jobs for the future.

Sir John Bell, Professor at Oxford University and Sir Jonathan Symonds, Chair, GSK chaired the Vision’s External Advisory Board to ensure the breadth and depth of the sector were represented in the Vision’s development. The board included representatives such as Dame Kate Bingham to help translate the success of the Vaccines Taskforce to other disease challenges.

Professor Sir John Bell, University of Oxford, Co-chair of the External Advisory Group said:

There is now a race to become one of the world leaders in the growth of Life Sciences as an industrial sector. We have demonstrated throughout the Covid pandemic how effective we can be when industry, academia, government, charities and the NHS all work together. If we continue to work as effectively together we are very likely to bring great benefits to patients and also to grow our economy at pace.

Sir Jonathan Symonds, Chairman, GSK, Co-chair of the External Advisory Group said:

Addressing the healthcare challenges we face today requires a life sciences strategy of bold ideas backed by evidence and data. The Vision we are setting out provides a new blueprint for how Government, the NHS and industry can work together to deliver the next generation of therapies, diagnostics and insights to improve patient health, to create a truly outstanding environment for healthcare companies to invest and grow, and to reinforce the UK’s position as a leading global destination for medical scientific research and investment.

Central to the Life Sciences Vision is a focus on cultivating a business environment in which UK life sciences firms can access finance to innovate and grow, are regulated in an agile and efficient way, and are incentivised to onshore manufacture and commercialise their products in the UK.

To support this ambition, the government has today also launched its Life Sciences Investment Programme, a £200 million government investment that will unlock the potential of innovative UK life sciences companies so that they can grow their operations and create high-skilled jobs in the UK.

The programme will leverage further private sector investment and support the development of a world leading UK life sciences venture capital ecosystem. The investment will be delivered through British Patient Capital, part of the government-owned British Business Bank, which will allocate the £200 million to specialist funds.

In a further boost to the sector, British Patient Capital has recently agreed a collaboration with Abu Dhabi’s Mubadala Investment Company, one of the world’s leading sovereign investors. Under this partnership, facilitated by the Office for Investment, Mubadala has committed to invest £800 million in the UK life sciences industry and will work with British Patient Capital to identify sector trends and investment opportunities.

In total, this means £1 billion of new funding is available for the UK’s most promising life sciences companies, with the potential to crowd in further funding from other investors.

The Life Sciences Investment Programme will have access to a scientific advisory panel composed of leading industry figures, chaired by Life Sciences Champion Professor Sir John Bell. The panel will share insight on key scientific trends.

The life sciences sector is critical to the UK’s health, wealth and resilience, employing more than 250,000 people and generating an £80 billion turnover each year in the UK. A key theme of the Vision is to support the sector to grow, attracting investment and creating high skilled jobs across the UK.

We use some essential cookies to make this website work.

We’d like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.

We use some essential cookies to make this website work.

We’d like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.

We also use cookies set by other sites to help us deliver content from their services.