Privacy Policy

Last updated: 6 August 2026

The short version

collects nothing

The browser extension

Makes no network requests at all. Your tools and settings stay on your own device. Nothing you transform is sent anywhere.

analytics & ads

The website

Uses Google Analytics and Google AdSense, which set cookies and receive usage data. The data you paste into the app is never among it.

This policy covers cyberchef.org (“the website”) and the CyberChef browser extension for Chrome, Edge and Firefox (“the extension”). They are operated by the same person and are described separately below, because the answers genuinely differ.

1. What you put into CyberChef

The most important point, and it applies to both surfaces: the text, files and recipes you enter into CyberChef are processed entirely inside your own browser. They are never uploaded, never sent to a server, and never seen by anyone else. There is no backend to send them to.

On the website this is a property of how the app is built — it is static files that run locally. In the extension it is stronger still: the extension makes no network requests whatsoever, which you can confirm in your browser's developer tools.

2. The browser extension

What it stores

The extension saves the following on your device, using your browser's extension storage:

• the tools you create — an operation, the argument values you saved with it, and any name you gave it;
• the order you arranged them in;
• interface settings, such as your theme choice and which surface you prefer.

Tools built from encryption, public-key or hashing operations are marked private and kept in local storage only, so they are never included in browser profile sync — a saved key must not leave the device. Other items may sync between your own devices through your browser account if you have browser sync switched on. That transfer is carried out by your browser, not by the extension, and is governed by your browser vendor's privacy policy.

Page access

The extension asks for access to the pages you visit so it can read a page when you ask it to — by pressing Grab, or by choosing one of your tools from the right-click menu. It declares no content scripts and runs nothing on page load. Content read from a page is placed into the extension's input for you to work with; it is not transmitted anywhere, and is not retained beyond your session unless you save it yourself.

If you prefer to grant access site by site, both Chrome and Firefox let you restrict it, and the extension handles that state rather than breaking.

What it does not do

The extension contains no analytics, no advertising, no telemetry, no crash reporting and no third-party services of any kind. It does not create an account, and there is nothing to log in to.

3. The website

The website is funded by advertising and uses two Google services. Unlike the extension, these do collect data about your visit.

Google Analytics

The site uses Google Analytics to understand aggregate traffic — how many people visit, which pages, roughly where from. It sets cookies and processes information such as your IP address, browser and device type, referring page, and the pages you view. It does not receive anything you type into the app.

Google AdSense

The site displays adverts through Google AdSense. Google and its partners may use cookies and similar technologies to serve and measure adverts, including personalised adverts based on your prior visits to this and other websites. Again, nothing you enter into the app is involved.

You can control this at Google Ads Settings, opt out of third-party cookie use for advertising at aboutads.info, and install Google's Analytics opt-out add-on. Your browser's own cookie and tracking-protection controls apply as well.

How Google handles data it collects on partner sites is described in Google's own policy.

Hosting

The website is hosted on Vercel, which processes standard server request logs — IP address, user agent, requested URL, timestamp — as a normal part of serving a page.

4. What is never collected

Neither surface collects, and neither has any means of collecting:

• the content you paste, type, upload or transform;
• names, email addresses or postal addresses — there are no accounts and no forms;
• payment or financial information — nothing is sold;
• passwords, keys or credentials;
• health information;
• precise location.

No data of any kind is sold, and none is used to assess creditworthiness or for lending.

5. Your rights

Depending on where you live, you may have rights to access, correct, delete, or object to the processing of personal data held about you, and to lodge a complaint with a data protection authority.

In practice, no account or contactable record about you is held, so there is usually nothing to retrieve or delete. Data collected through Google Analytics and AdSense is handled by Google, and the opt-out links in section 3 are the fastest route. For the extension, everything it stores is on your own device: clearing your browser's data for the extension, or uninstalling it, removes all of it.

If you want to make a request anyway, use the contact address below.

6. Children

Neither the website nor the extension is directed at children, and neither knowingly collects data from them. The extension collects no data from anyone.

7. Changes

Any change to this policy will be published at this URL with the date at the top updated. Material changes affecting the extension will accompany a new release.

8. Contact

Questions about this policy, or about data handled by the website or the extension: info@def24.com.

9. About CyberChef itself

CyberChef is an open-source project by GCHQ, licensed under Apache-2.0 and available at github.com/gchq/CyberChef. This website and the extension are an independent packaging of it and are not affiliated with or endorsed by GCHQ. This policy covers only this website and this extension.