OneTaskBy Tim King · Updated
JavaScript Deobfuscation Helper
Decode Obfuscated JavaScript Strings and Flag eval Calls, Without Running It
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the JavaScript Deobfuscation Helper works
This JavaScript deobfuscation helper reveals the strings hidden in obfuscated scripts, such as injected skimmers, malicious ads and suspicious browser extensions. It rewrites the code statically, so nothing you paste is ever run, and it lists the lines that do something risky.
What the JavaScript deobfuscation helper rewrites
Obfuscators hide URLs and function names so a reader cannot see what a script does. The helper undoes the common tricks and repeats until nothing more changes.
'\x68\x74\x74\x70'and'a'escapes become plain text.String.fromCharCode(104, 105)with literal numbers becomes'hi'.'ev' + 'al'concatenation of literals is joined.atob,unescapeanddecodeURIComponentcalled on a literal are decoded.'olleh'.split('').reverse().join('')becomes'hello'.- Lookups into a string array, such as
_0x1a2b[0x3], are replaced with the value. document['cookie']becomesdocument.cookie.
The patterns table then marks lines that use eval or the Function constructor, write HTML, add scripts, redirect the page, read cookies or storage, make network requests or contain URLs.
The result is usually still on one long line. Paste it into the JavaScript formatter to lay it out.
FAQ
Why is some code still unreadable?
Heavy obfuscators wrap the string array in a decoder function or rotate it at runtime, and working that out would mean running the code. This helper only rewrites what can be read safely, which usually reveals the URLs and key calls even when the structure stays tangled.
Is it safe to paste malware here?
Yes. The code is treated as text and changed with pattern matching. Nothing is evaluated, no script tag is created and no URL is fetched, so pasting a live skimmer does not run it.
Does a flagged eval mean the script is malicious?
Not by itself. Old libraries and some build tools use eval legitimately. It matters when combined with decoded URLs you do not recognise, cookie access or redirects in code that should not need them.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
JavaScript Formatter
Expand minified JavaScript into indented code, or squash it back.
Multi Decoder
Detect and unwrap nested Base64, URL, hex and entity encodings automatically.
Base64 Encoder / Decoder
Encode and decode Base64, standard or URL-safe.
URL Extractor
Pull every link out of a block of text.
HTML Entity Encoder
Escape and unescape HTML entities in any text.