It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1]. The magic implementation is here[2].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F... [1] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F... [2] https://github.com/gchq/CyberChef/blob/master/src/core/lib/M...