JavaScript Deobfuscator

Unlock and simplify obfuscated or packed JS code (Best effort)

JavaScript Tool

Recovered Code

Unwrap simple layers of obfuscated JavaScript

Some scripts hide their real content behind a thin wrapper, such as a Base64 string passed to atob and then to eval, or a list of numbers fed to String.fromCharCode. This tool peels off those two common wrappers and then formats what it finds, so you can see the underlying source. It is a best-effort helper for inspecting suspicious snippets or recovering your own old code, not a universal unpacker.

Using it

Paste the obfuscated script into the Obfuscated Code box. Load Sample fills in an example that has two layers of Base64, and Clear resets the box.
Click Decode & Beautify.
The Recovered Code panel shows the result. Use Copy to copy it.

What it actually does

The steps run in a fixed order. If the input starts with eval( and ends with );, the wrapper is stripped. If an atob call containing a quoted string is found, that string is Base64-decoded. If a String.fromCharCode call is found, its list of numbers is turned into text. If the output still contains eval( or atob(, the process repeats on it. Finally the result is run through a beautifier so it has line breaks and indentation. Importantly, the tool never executes your code. It only reads and rewrites the text, so a malicious script cannot run during decoding.

When it helps

Checking what a suspicious snippet found in a compromised page or plugin is trying to do.
Reading an old script that was wrapped with a simple encoder.
Learning how basic eval and Base64 obfuscation works in practice.
Recovering source from a snippet whose original file was lost.

Where it stops

It only handles the two patterns described. Output from dedicated obfuscators that rename variables, flatten control flow or encrypt string tables, and packed code in the p,a,c,k,e,d style, will not be reversed, and you will get the input back merely reformatted. Only the first atob or fromCharCode match is decoded, and it replaces the whole text, so any code around that call is lost. Numbers must be plain decimal or 0x hexadecimal. Errors are not reported, so when nothing seems to change, the script most likely uses a technique outside this scope. If the decoded result looks harmful, do not paste it into a console or run it.

Related Tools

Frequently Asked Questions

Does the tool run the obfuscated code?

No. It reads the text and rewrites it using pattern matching and decoding, without evaluating anything. That means a harmful script cannot execute while being analysed, though you should still avoid running the recovered code yourself.

Which obfuscation styles can it reverse?

Wrappers built from eval, atob Base64 strings, and String.fromCharCode number lists, including nested layers. It cannot undo renamed variables, control-flow flattening, string-array encoders, or packed p,a,c,k,e,d scripts.

Why did I get back nearly the same code?

The script probably uses a technique outside the two supported patterns. In that case the tool cannot decode anything and only beautifies the text. The tool shows no error message for unsupported input, so an unchanged result is the only sign that nothing could be decoded.

Is code around the atob or fromCharCode call kept?

Not necessarily. When a match is found, the decoded text replaces the whole input, so surrounding code is dropped. This works for classic single-payload wrappers but can lose other statements in more complex scripts.

Can I decode hexadecimal character codes?

Yes, numbers in a String.fromCharCode list may be decimal or written with a 0x prefix. Other escape styles, such as strings written with \x escapes, are not decoded here, though the JavaScript Beautifier's Unescape Strings option can help.