Softonic

JavaScript Deobfuscator

Step 1 / 2
Deobfuscate

Paste a blob of obfuscated JavaScript, hex-encoded strings, single-letter variable names, a decoder loop at the top, and the tool peels back the layers: unescape strings, inline the lookup array, rename variables to readable placeholders, flatten trivial wrappers and beautify the result. Useful for analyzing suspicious snippets you pulled from a page or a pasted pastebin link.

How to deobfuscate JavaScript

  1. 1

    Paste the obfuscated source

    Minified, packed, or output from `javascript-obfuscator.io` style tools.

  2. 2

    Let the parser walk it

    String arrays are decoded, numeric sequences are evaluated, and dead code branches are pruned.

  3. 3

    Apply renaming

    Single-letter `a`/`b`/`c` variables get renamed to `var1`, `var2`, etc. readable placeholders, not necessarily meaningful names.

  4. 4

    Beautify

    Indent, add newlines, and output code you can actually read and reason about.

Techniques the deobfuscator reverses

Obfuscation Reversal
Hex-escaped string literals Decode \x48\x69 back to "Hi"
Unicode-escaped identifiers \u006E\u0061\u006D\u0065 -> name
String array + decoder function Inline the array, call decoder at parse time
Numeric constant folding 0x1F3 + 5 -> 504
eval(...) wrappers Lift the inner code to top level
Control-flow flattening (state machine) Detect the switch-case, reconstruct flow
Dead code / useless ternaries Remove branches that never execute
_0x1a2b3c() style names Replace with incrementing var1, var2

Limits: what the tool does not do

  • Recover original variable names. Once userEmail is renamed to a, no tool can guess it back. You get readable structure, not original semantics.
  • Unpack custom virtualizers. Heavyweight commercial obfuscators (JScrambler, enterprise tiers of Obfuscator.io) introduce a custom VM that interprets bytecode. Defeating those requires manual reverse engineering.
  • Run arbitrary code. The deobfuscator evaluates pure expressions statically. It will not fetch remote resources, create DOM elements or talk to the network.

Typical use cases

  • Security research: pulling apart a suspicious script that arrived in an email or was served by a compromised CDN.
  • Code archaeology: recovering legacy code where the only surviving artefact is a minified bundle.
  • Learning: understanding what a tutorial-level obfuscation actually does under the hood.

Safety and ethics

Never run untrusted JavaScript in a browser tab logged into anything important, the code can read cookies, call internal APIs and exfiltrate state. The deobfuscator itself operates on the source as text; it does not execute the code you paste.

Only deobfuscate code you are authorized to analyze. Reverse engineering licensed software may be restricted in your jurisdiction.

Frequently Asked Questions

No. Once the obfuscator renames userEmail to _0x1a2b3c, the original name is lost. The deobfuscator gives you readable placeholders (var1, var2) and correct structure, but not the original semantic names.

No. It parses the code as an AST and applies static transformations. Pure expressions (like 0x1F3 + 5) are folded, but nothing touches the network, cookies or the DOM.

Yes, but bundler output is minified rather than deliberately obfuscated, so the result is just beautified code with module wrappers restored. Source maps, if available separately, give you far better names.

Heavy commercial tools (enterprise JScrambler, custom VMs) introduce a bytecode interpreter that static analysis cannot unwind. The tool will get the surface layer but the core logic remains opaque without manual reversing.

Related Tools

ASCII Table Reference

Full ASCII table from 0 to 127 with decimal, hex, octal, binary, standard names and HTML numeric-reference notation, including NUL, LF and DEL.

Color Palette Generator

Generate monochromatic, analogous, complementary, triadic or tetradic color palettes from a base HEX color and export copy-ready CSS variables.

HTML Character Reference

Searchable list of HTML entities, their named and numeric codes, and a one-click copy for special characters and symbols.

HEX Color Picker

Pick or enter a HEX colour and get RGB, HSL, approximate CMYK, relative luminance and contrast ratios against white and black.

FPS Counter

Measure browser FPS with requestAnimationFrame, smoothing, min/max frame rate, warnings and an optional graph. Runs locally with no upload or API.

JSON Formatter

Paste JSON to pretty-print with 2 or 4 spaces, minify it to compact output, or run a quick syntax check before copying the result.

Tool available in other languages