Feature Request: Add Thrift Serialization / Deserialization operations
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Is your feature request related to a problem? Please describe.**
> I'm always frustrated when I need to analyze or debug Thrift-encoded binary payloads (e.g., captured from network traffic or RPC calls). Currently, there is no built-in way in CyberChef to decode or encode Apache Thrift serialized data, which forces me to write custom scripts or use external tools just to inspect the content.
---
**Describe the solution you'd like**
> Add two new operations to CyberChef:
>
> - **Thrift Deserialize** – Takes a Thrift binary blob (TBinaryProtocol or TCompactProtocol) as input and outputs a human-readable JSON representation of the decoded fields (field ID, type, value).
> - **Thrift Serialize** – Takes a JSON-structured input and encodes it into Thrift binary format.
>
> Ideally, the operation should support the following protocols via a dropdown option:
>
> - `TBinaryProtocol` (standard)
> - `TCompactProtocol` (compact variable-length encoding)
> - `TJSONProtocol`
>
> Since no IDL/`.thrift` schema file is available at runtime, the deserializer should work in **schema-less mode** (similar to how Protobuf Decode works in CyberChef), inferring field types from the wire encoding.
---
**Describe alternatives you've considered**
> - **Writing a custom Python/Node.js script**: Works but is inconvenient and not portable — CyberChef's appeal is having everything in one place in the browser.
> - **Using online Thrift decoders**: Very few exist, none are as flexible or composable as CyberChef operations.
> - **Protobuf Decode (existing CyberChef op)**: Protobuf and Thrift are similar in concept, but their wire formats are incompatible. The existing Protobuf operation cannot handle Thrift data.
---
**Additional context**
> - Apache Thrift is widely used in microservices, internal RPC frameworks, and some open protocols (e.g., Cassandra, HBase, Scribe).
> - This feature would be particularly valuable for **security researchers and CTF players** analyzing binary network traffic.
> - A JavaScript/Node.js Thrift library ([`thrift`](https://www.npmjs.com/package/thrift)) is available on npm and could serve as the implementation basis.
> - Reference specs:
> - [Thrift Binary Encoding](https://github.com/apache/thrift/blob/master/doc/specs/thrift-binary-encoding.md)
> - [Thrift Compact Protocol](https://github.com/apache/thrift/blob/master/doc/specs/thrift-compact-protocol.md)
> - This would complement existing serialization ops: **Protobuf Decode**, **From MessagePack**, **From CBOR**, etc.
Contributor guide
Research direction
Start by reviewing CyberChef's existing Protobuf Decode, From MessagePack, and From CBOR operations, then read the linked Thrift Binary, Compact, and JSON protocol specifications. Done means adding Thrift Serialize and Thrift Deserialize operations with the requested protocol choices and a defined schema-less JSON representation for encoded fields.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- data, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100