Deobfuscate packed and obfuscated JavaScript code. Detect eval-based packers, hex encoding, and string rotation.
Obfuscated JavaScript often hides meaningful strings behind packed eval calls, hexadecimal escapes, or shuffled lookup tables. This tool examines pasted source for those specific patterns and produces a more readable form when it recognizes them. It is intended for inspecting code, not proving what the code will do in every browser state. The point most often missed is that deobfuscated code is not necessarily the original code: lost comments and meaningful identifier names cannot be reconstructed, and a cleaner result is not evidence that the script is safe.
The first pass identifies known eval-based packing wrappers, hexadecimal escapes in JavaScript string literals, and string-table rotation patterns. For a recognized wrapper, the useful result is the source that the wrapper conceals; for an escaped literal, it is the equivalent readable characters; for a rotated table, it is the corrected association between indexes and strings. Ordinary program logic outside those patterns is retained for inspection.
Obfuscation techniques can be nested: a packer can reveal code that still contains escaped strings or rotated indexes. Read the result as another JavaScript listing and check it for dynamic constructors, computed member names, concatenated fragments, and remaining lookup arrays. Values that depend on DOM contents, storage, time, randomness, user input, or a response received later cannot be recovered from source text alone.
No. eval is a JavaScript language feature that evaluates a string as code, and non-obfuscated programs can use it. This tool's eval-based packer detection is a clue about structure, not proof of malicious intent. Inspect the recovered string, its inputs, and the surrounding call path before deciding why eval is present.
The pasted source is processed in the browser and is not uploaded, so server-side disclosure is not part of this tool's use. Still treat the sample and transformed output as untrusted JavaScript. Do not execute either in a page console, and avoid copying secrets unrelated to the analysis. Local processing is a privacy boundary, not a safety verdict.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.