PyChef documentation

PyChef is an unofficial, pure-Python data-transformation library inspired by CyberChef. It runs recipes and reusable pipelines inside normal Python scripts, tests, services, notebooks, and CTF tooling. The published package has no runtime dependency on Node.js or JavaScript.

The PyPI distribution is named cyberchef-py. The import is named pychef. PyChef currently registers 502 operation names from the pinned CyberChef 11.3.0 inventory. Name coverage and exact option-level compatibility are deliberately reported separately; read Compatibility and current status before relying on an uncommon format or protocol variant.

Start here

• Getting started installs the package and performs a first transformation.

• Text, bytes, and structured data explains when PyChef uses str and when it uses bytes.

• Recipes explains CyberChef-compatible recipe dictionaries.

• Pipelines explains immutable, composable Python transformations.

• Operation reference lists every operation, its arguments, status, and examples.

• CTF and binary tools covers packing, endianness, XOR, hashes, cyclic patterns, and AES.

• Packets, PCAP, and PCAPNG turns network packets, PCAP, and PCAPNG into Python dictionaries.

Learn

• Getting started
  • Requirements
  • Install from PyPI
  • Your first recipe
  • Your first pipeline
  • Discover operations
• Text, bytes, and structured data
  • str and bytes
  • Explicit byte formats
  • Structured pipeline values
  • Recipe arguments
• Recipes
  • Accepted step forms
  • Validate and reuse a recipe
  • Inspect errors and progress
  • Flow-control operations
  • Convert between pipelines and recipes
• Pipelines
  • Add operations
  • Reuse and batch processing
  • Compose pipelines
  • Append Python logic
  • Branches and concatenation
  • Select structured output
  • Trace intermediate results
  • Typed CTF and packet stages
• Practical examples
  • Decode an unknown hexadecimal text
  • Create a reusable file fingerprint function
  • Try several decoders without rebuilding them
  • Build a binary payload
  • Inspect a packet capture
  • AES-GCM with associated data
• CTF and binary tools
  • Packing and endianness
  • Payload construction
  • Cyclic patterns
  • XOR and rotations
  • Hashing
  • AES
• Packets, PCAP, and PCAPNG
  • Read a capture
  • Supported layers
  • Parse individual layers
  • Use packet parsers in pipelines
  • JSON output
  • Resource limits and malformed input
• Errors, safety, and performance
  • Error classes
  • Network access
  • Cryptography
  • Untrusted and large inputs
  • Performance

Reference

• Operation reference
  • Browse by category
  • All operations
• Python API reference
  • Top-level package
  • Recipes and execution
    • Recipe
    • Chef
    • bake()
  • Pipelines
    • Pipeline
    • PipelineTrace
  • CTF helpers
    • aes_decrypt()
    • aes_encrypt()
    • aes_gcm_decrypt()
    • aes_gcm_encrypt()
    • chunks()
    • cyclic()
    • cyclic_find()
    • decode_bytes()
    • digest()
    • digests()
    • encode_bytes()
    • flat()
    • hexdump()
    • md5()
    • p8()
    • p16()
    • p16be()
    • p16le()
    • p32()
    • p32be()
    • p32le()
    • p64()
    • p64be()
    • p64le()
    • pack()
    • rol()
    • ror()
    • sha1()
    • sha256()
    • sha512()
    • swap_endian()
    • u8()
    • u16()
    • u16be()
    • u16le()
    • u32()
    • u32be()
    • u32le()
    • u64()
    • u64be()
    • u64le()
    • unpack()
    • xor_bytes()
  • Packet and capture parsers
    • json_safe()
    • packet_json()
    • parse_arp_packet()
    • parse_capture()
    • parse_dns_message()
    • parse_ethernet_frame()
    • parse_icmp_message()
    • parse_ipv4_packet()
    • parse_ipv6_packet()
    • parse_packet()
    • parse_pcap()
    • parse_pcapng()
    • parse_tcp_segment()
    • parse_udp_datagram()
    • read_capture()
  • Operation registry
    • Operation
    • OperationRegistry
    • operation()
    • implementation()
  • Compatibility report
    • CompatibilityReport
    • compatibility_report()
  • Public types
    • to_bytes()
    • to_text()
    • RecipeStep
    • BakeResult
  • Exceptions
    • PyChefError
    • UnknownOperationError
    • OperationError
    • RecipeError
• Compatibility and current status
  • Pinned reference
  • What “implemented” means
  • Known broad boundaries
  • Inspect status from Python
• Attribution and licenses

Project

• Contributing to PyChef and its documentation
  • Set up the repository
  • Run the project checks
  • Build the documentation
  • Operation reference generation
  • Document a changed operation
• Frequently asked questions
  • Why do I install cyberchef-py but import pychef?
  • Does PyChef need Node.js or JavaScript?
  • Why did an operation return bytes instead of str?
  • How do I pass operation options?
  • How do I chain an operation with normal Python code?
  • How do I see intermediate values?
  • Does 100% operation-name coverage mean exact CyberChef parity?
  • Can I use the AES implementation for production secrets?
  • How do I update the documentation after changing an operation?

Indices

• Index

• Module Index

• Search Page