Paste a mystery value, hit “What is this?”, and ANVIL tells you what it is — a Windows FILETIME, a SID, a GUID, Base64, a JWT, a defanged IOC — and decodes it. Or chain operations into a recipe, like a native, offline CyberChef tuned for the formats forensic and OSINT analysts actually hit.
An open-source NEATLABS tool · MIT · one dependency · 100% local, nothing leaves your machine
Every analyst keeps a junk drawer of half-remembered conversions: which epoch is this 18-digit number? what's this binary SID? is this Base64 or Base64URL? what does this xn-- domain really say? CyberChef is brilliant for this — but it's browser-based and general-purpose, and a lot of the genuinely forensic formats are awkward or missing.
ANVIL is the native, offline complement: a desktop workbench whose 50+ operations are tuned for digital forensics and OSINT, with a “What is this?” detector that identifies an unknown blob for you. It's the kind of tool you keep open all day.
It runs entirely on your machine — no account, no API, no telemetry — so it's fine on an evidence workstation or an air-gapped network.
Not ready to paste your own data? Click 📋 Try a sample for a gallery of 28 ready-made examples across every category — a mystery timestamp, a binary SID, a JWT, a defanged IOC, a layered-encoding recipe, and more. Each one loads into the workbench and shows the result immediately, so you can evaluate ANVIL in about a minute before it ever touches real evidence.
Paste an unknown value and ANVIL ranks the likely interpretations, previews each, and lets you drop one into the recipe with a click. It doesn't guess from shape alone — it actually runs the candidate decoders and checks whether the output is meaningful. The headline case is timestamps: paste a raw integer and ANVIL shows you every forensic epoch at once and marks the one that lands in a plausible date range.
Timestamps — the part CyberChef handles least well. One-click Identify interprets a number as Unix (s/ms/µs/ns), Windows FILETIME, Chrome/WebKit, Apple Cocoa, HFS+, OLE Automation and DOS date/time simultaneously, flagging the plausible reading. Plus dedicated converters for each.
Identifiers — GUID/UUID parsing (version, variant, embedded v1 timestamp + MAC), GUID-from-raw-bytes (Microsoft mixed-endian), Windows SID ⇄ binary with well-known-SID naming, JWT decode with human-readable iat/exp/nbf, IP address inspection (v4/v6/integer), MAC formatting.
Encoding — Base64 / Base64URL / Base32 / Base58 / Base85, hex ⇄ text (UTF-8/16), URL, HTML entities, quoted-printable, ROT13/47, Unicode unescape, Punycode/IDN (homograph check), number-base conversion, hex dump.
Hashing & analysis — MD5/SHA-1/SHA-256/SHA-512/CRC32, hash identification, Shannon entropy (spot encryption/compression), data stats.
Text & data — JSON pretty/minify/validate, XML pretty, strings extraction, case conversion, line sort/unique.
IOC & threat intel — defang/refang (hxxp, [.]) and IOC extraction (pull IPs, domains, URLs, emails, hashes out of a blob of logs).
Deobfuscation & hidden — reveal/strip invisible Unicode (zero-width, bidi and tag characters used for C2 steganography, prompt injection and homographs) and decode/deobfuscate PowerShell (-EncodedCommand base64, backtick and concat tricks), with danger-indicator flagging for the script behind a ClickFix lure.
Chain operations together — the output of each feeds the next — and tune their parameters inline. Reorder or remove steps; the output re-bakes live.
ANVIL needs Python 3.10+ and one dependency.
git clone https://github.com/neatlabs-ai/anvil.git
cd anvil
pip install -r requirements.txt
python main.pyOn Linux you may also need Tk: sudo apt install python3-tk.
Run it from the project folder.
main.pyneeds thegui/andanvil/folders next to it. If you seeModuleNotFoundError: No module named 'gui',cdinto the folder that contains them and run there.
anvil/
core.py # Operation model, registry, recipe chaining
ops_encoding.py # base64/32/58/85, hex, url, html, rot, unicode, punycode, bases
ops_time.py # FILETIME, Unix, Chrome, Cocoa, HFS+, OLE, DOS + multi-epoch identify
ops_ident.py # GUID/UUID, SID, JWT, IP, MAC
ops_hash.py # hashes, hash-id, entropy, stats
ops_text.py # JSON/XML, strings, case, lines, defang/refang, IOC extract
detect.py # the "What is this?" ranked detector
gui/ # CustomTkinter workbench (operations browser / input / recipe / output / detect)
main.py # launch
Every operation is a small data → result function in a registry, which is what makes them composable into recipes — and trivial to extend (add one function, decorate it with @register, done). Pure standard library; the only third-party dependency is the GUI toolkit.
The conversions are the product, so they're anchored to known values in the code's tests — FILETIME 116444736000000000 is exactly 1970-01-01 00:00:00 UTC, Cocoa 0 is 2001-01-01, HFS+ 0 is 1904-01-01, and SIDs round-trip with their well-known names. If you find a conversion that's off, that's a bug worth filing.
ANVIL — a NEATLABS tool
Point of contact: Randy B. · ✉️ info@neatlabs.ai · 🌐 neatlabs.ai
Local · offline · MIT License · Contributions welcome — see CONTRIBUTING.md