JavaScript DeObfuscator
Deobfuscate JavaScript — unpack scrambled code enough to read its intent.
How to use JavaScript DeObfuscator
- Paste the suspicious script — as text; never execute it first.
- Read the unpacked output — formatted, strings decoded where mechanically possible.
- Hunt the signals: URLs, password-field access, eval, cookie reads — decoded strings usually confess first.
- Escalate appropriately — confirmed malice in a site means cleanup and credential rotation, not just deletion.
What is JavaScript DeObfuscator?
A JavaScript deobfuscator reverses the mechanical layers of code scrambling: reformatting the crushed text, decoding encoded strings, simplifying the indirection tricks (hex escapes, array-shuffled string tables, unnecessary wrappers) that obfuscators inject — recovering code readable enough to understand its intent.
The natural use is defensive: something suspicious landed in front of you — a script tag in a hacked site, a "paste this into your console" snippet, an npm dependency acting oddly, a browser-extension file — and you need to know what it does before it does it. Obfuscation on unexpected code is itself a red flag; deobfuscation is how you look inside.
About the JavaScript DeObfuscator
Paste obfuscated JavaScript and get it unpacked as far as mechanical transforms allow: formatted structure, decoded string literals, simplified expressions — the intent visible even where original names are gone forever.
What analysis looks for once readable: network destinations (what URLs does it call — exfiltration shows up here), DOM access to sensitive fields (password inputs, form data), eval/Function construction (code that builds more code), cookie and storage access, and crypto-mining or redirect patterns. Decoded strings usually tell the story fastest — obfuscators hide URLs and keywords precisely because they're incriminating.
Limits, honestly: renamed identifiers stay renamed (names were destroyed, not hidden), and heavy commercial obfuscation with VM-based layers resists casual unpacking. For most real-world malicious snippets — which favor cheap, common obfuscation — one pass reveals plenty. Treat everything pasted here as text; never run suspect code to "see what happens".