Feature Request: Add Thrift Serialization / Deserialization operations
#2374 opened on May 12, 2026
Description
Is your feature request related to a problem? Please describe.
I'm always frustrated when I need to analyze or debug Thrift-encoded binary payloads (e.g., captured from network traffic or RPC calls). Currently, there is no built-in way in CyberChef to decode or encode Apache Thrift serialized data, which forces me to write custom scripts or use external tools just to inspect the content.
Describe the solution you'd like
Add two new operations to CyberChef:
- Thrift Deserialize – Takes a Thrift binary blob (TBinaryProtocol or TCompactProtocol) as input and outputs a human-readable JSON representation of the decoded fields (field ID, type, value).
- Thrift Serialize – Takes a JSON-structured input and encodes it into Thrift binary format.
Ideally, the operation should support the following protocols via a dropdown option:
TBinaryProtocol(standard)TCompactProtocol(compact variable-length encoding)TJSONProtocolSince no IDL/
.thriftschema file is available at runtime, the deserializer should work in schema-less mode (similar to how Protobuf Decode works in CyberChef), inferring field types from the wire encoding.
Describe alternatives you've considered
- Writing a custom Python/Node.js script: Works but is inconvenient and not portable — CyberChef's appeal is having everything in one place in the browser.
- Using online Thrift decoders: Very few exist, none are as flexible or composable as CyberChef operations.
- Protobuf Decode (existing CyberChef op): Protobuf and Thrift are similar in concept, but their wire formats are incompatible. The existing Protobuf operation cannot handle Thrift data.
Additional context
- Apache Thrift is widely used in microservices, internal RPC frameworks, and some open protocols (e.g., Cassandra, HBase, Scribe).
- This feature would be particularly valuable for security researchers and CTF players analyzing binary network traffic.
- A JavaScript/Node.js Thrift library (
thrift) is available on npm and could serve as the implementation basis.- Reference specs:
- This would complement existing serialization ops: Protobuf Decode, From MessagePack, From CBOR, etc.