Not OP and I've never seen CyberChef before, but personally I'm very uncomfortable pasting secrets into any web application, even an open-source one.

Self-hosting would at least give me the guarantee that the code I'm running is the same code I ran last week: If nothing left my browser then, it probably isn't leaving my browser today.

I don't get that guarantee with someone else's hosted version.

Exactly what @lolinder says. If I pin the version of cyberchef, I don't need to worry about leaking secrets _ever_. And I'm very anxious about pasting something to the first "decode base64" search engine result.