Cyberchef: Misc: Explanation when data is transferred to the server

[Perflyst]

When is pasted data uploaded to server?

Please write somewhere down when and what data is uploaded to the server.
Can this be trusted with e.g. private gpg key and passphrase (I will never paste any of that there but still interesting)?

I have seen that the url changes, e.g. &input=. Is this string in webserver log?

[masq]

Data is never transferred to the server. Everything in CyberChef is done
client side. It uses the URL hash to "store" the information so you can
pass it around to others, but that doesn't leave your client until you've
sent someone the URL. The only utility the server provides is sending the
CyberChef code bundle to the client.

On Thu, Oct 18, 2018, 08:52 Perflyst [e-mail] wrote:

When is pasted data uploaded to server?

Please write somewhere down when and what data is uploaded to the server.
Can this be trusted with e.g. private gpg key and passphrase (I will never
paste any of that there but still interesting)?

I have seen that the url changes, e.g. &input=. Is this string in
webserver log?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/gchq/CyberChef/issues/396, or mute the thread
https://github.com/notifications/unsubscribe-auth/AHnzfMwT7D7EW9TynOTkiJwvt7NIV-Rjks5umKPVgaJpZM4XtvqI
.

[n1474335]

Thanks @masq. You are correct that no input or recipe data ever leaves the user's browser. This is one of the core design decisions behind CyberChef. Everything is carried out on the client side.

We do have Google Analytics installed in the live demo so that we can get an idea of usage statistics, but this does not collect the full URL. We specifically enforce this here: https://github.com/gchq/CyberChef/blob/3c4893d7c7e149186e30c4f8f1da84e27abe1a1c/src/web/static/ga.html#L12-L14

If you really want to be certain, you can download the standalone version of CyberChef (by clicking the link in the top left of the web app) and run it in a virtual machine. This version doesn't include the Google Analytics code either.

[Perflyst]

Thank you very much for the detailed information. I set up an own instance with no analytics. I like the idea and the huge list of features (btw you release faster than I can update)

[n1474335]

Ha yes, we do go through busy phases! This is one of the reasons why we prefer that people use the live demo because we are fixing bugs all the time. A tool like CyberChef can never be "finished", so if you want the latest, greatest version of it, the live demo is the best place to go.

It's also modular so should load faster. The standalone version is bundled together into one big blob so your browser has to parse 8MB of highly compressed JavaScript every time you open it. The live demo only loads a subset of operations to begin with and then downloads blocks of further operations as required.