Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Free tool
Paste obfuscated JavaScript and see what it's actually doing, this decodes the string-escape, char-code, base64, and eval-packer tricks that show up constantly in the wild, then formats the result. It never executes the code you paste, even the packed payload itself, so it's safe to try on something you don't fully trust.
Everything runs in your browser via pure string decoding, this tool never executes the code you paste, even the packed/obfuscated payload itself, so it's safe to try on something you don't fully trust. It decodes the most common real-world tricks (string escapes, char-code arrays, base64 literals, and the classic eval-packer format) and formats the result , it won't reverse professional-grade obfuscation with control-flow flattening.
By using this tool, you agree to our Terms of Service , only run it against something you own or are authorized to assess.
This handles the common cases, professionally obfuscated or control-flow-flattened code needs real manual analysis. Talk to us if you've found something concerning.