🔍 JavaScript Deobfuscator and Beautifier

What is the JavaScript Deobfuscator and Beautifier?

Obfuscation is any transformation that keeps code working while making it hard for a human to read. The lightest and most common forms are pure encoding: instead of writing the character H, a script writes \x48 (its hex value), \u0048 (its unicode escape), or hides a whole string inside String.fromCharCode(72, ...). URLs and payloads are often percent-encoded as %2F, %20 and so on, the same encoding you see in a browser address bar. None of these change what the code does. They only change how it looks, so a good first step in reading unfamiliar JavaScript is to reverse the encoding and put the real characters back.

This deobfuscator does exactly that decoding, and only that decoding. It walks the text with a set of pattern replacements: every \xHH becomes its single character, every \uHHHH becomes its character, every %XX is turned back into its byte through the browser's own decodeURIComponent, and any String.fromCharCode call whose arguments are plain numbers is replaced with the literal string those numbers spell. Crucially, it does none of this by executing the code. A malicious script can hide a call like eval(atob(...)) that only reveals its payload when it runs, so any tool that runs your input to unpack it is itself a security risk. This tool uses safe text substitution, which means it can never trigger a payload, but also means it will not unwrap things that only exist at runtime.

After decoding, the beautifier restores structure. Minified code is usually squashed onto one line with every optional space and newline removed. The formatter inserts a newline after each semicolon and around each curly brace, then indents every line by the running brace depth at two spaces per level, so a function body sits one level in, a nested if sits two levels in, and so on. The result is not guaranteed to be byte-for-byte identical to the original source (the numbering and spacing are reconstructed, not recovered), but it reads like normal code and lets you follow the control flow.

Tools that unpack JavaScript generally fall into three families. Text-substitution tools, like this one, scan the raw text for known patterns and replace them without ever running the code; they are fast, safe, and limited to encodings that are visible in the source. AST-based tools instead parse the code into an abstract syntax tree, a structured model of every statement and expression, which lets them safely rename variables, fold constant expressions, and even unravel control-flow flattening because they understand the code's structure rather than just its text. Sandboxed evaluators go a step further and actually run the obfuscated bootstrap function, such as an obfuscator.io string-array rotator or a Dean Edwards packer, inside an isolated environment so the real payload reveals itself the same way it would in a browser, just without the risk of it touching your real page. Each approach trades safety for power: text substitution is the safest and the least capable, sandboxed evaluation is the most capable and carries the most risk if the sandbox is not properly isolated.

It is important to be honest about the limits. This is a readability aid, not a full unminifier or a reverse-engineering suite. It will not rename single-letter variables back to meaningful names, undo control-flow flattening, unpack the dean-edwards p,a,c,k,e,d format, decrypt runtime-generated strings, or handle nested layers that decode themselves as they run. For those you need a tool that actually parses and, in some cases, safely sandboxes the code. What this tool does well is the eighty percent case: a snippet that looks scary only because it is full of \x escapes and squashed onto one line becomes plain, indented JavaScript you can actually read.

A note on the beautifier's naive brace counting: because it does not parse strings, a curly brace that appears inside a string literal or a regular expression will be counted as a real brace and can throw the indentation off by a level. This is a deliberate trade-off that keeps the tool tiny, fast, and eval-free. If the indentation looks wrong on a particular line, it is almost always because a brace was hiding inside a string, and the decoded text itself is still correct.

When to use it

• Reading a suspicious inline script found on a web page before deciding whether it is safe, without ever running it.
• Turning a one-line minified snippet from a bug report or a Stack Overflow answer into indented code you can follow.
• Decoding strings that were hidden with \xHH or \uHHHH escapes so you can see the real URLs, messages, or selectors.
• Expanding String.fromCharCode(...) sequences that spell out hidden text such as a tag name or an endpoint.
• Recovering the readable form of a percent-encoded payload copied from a network request or a URL.
• Teaching or learning how basic JavaScript obfuscation works by watching escapes turn back into plain characters.

How to use the JavaScript Deobfuscator and Beautifier

1. Paste the obfuscated JavaScript into the input box, or click Load sample to try it on a prepared snippet.
2. Leave all four options ticked to decode escapes, decode %XX sequences, expand String.fromCharCode, and beautify, or untick any you do not want.
3. Click Clean and beautify (it also runs automatically as you type).
4. Read the result in the output box, using the indentation to follow the structure.
5. Click Copy to put the cleaned code on your clipboard.

Formula & method

Worked examples

Common encodings this tool decodes

What it can and cannot do

Obfuscation formats beyond this tool, and how to unpack them

Common mistakes to avoid

• Expecting it to fully reverse heavy obfuscation. This is a readability aid. It decodes escapes and reindents code, but it will not rename variables, unpack self-decrypting payloads, or undo control-flow flattening. For those you need a dedicated parsing or sandboxing tool.
• Assuming it runs the code to unpack it. It never evaluates your input. That keeps you safe from malicious payloads, but it also means anything hidden behind a runtime eval or atob call will stay hidden, because it only exists once the code executes.
• Trusting the indentation after a brace inside a string. The beautifier counts every curly brace, including ones inside string literals or regular expressions, so a brace hidden in a string can push the indent off by a level. The decoded characters are still correct; only the spacing is affected.
• Pasting code from an untrusted source and then running it anyway. Reading a script here does not make it safe to execute. Deobfuscation helps you understand what code would do; it does not vet it. Never run untrusted JavaScript on a real page or server just because you can now read it.
• Expecting obfuscator.io or packer code to unpack automatically. This tool only substitutes literal escape patterns it can see in the source. It does not simulate the array-rotation loop obfuscator.io generates, and it does not evaluate a Dean Edwards eval(function(p,a,c,k,e,d)) packer, so code obfuscated with those tools will decode only partially, if at all.
• Confusing minification with obfuscation. Minified code from a bundler like Terser or esbuild has short variable names and no whitespace, but it is not hiding anything; running just the beautify step here already makes it readable. True obfuscation adds encoding or structural tricks on top of that, which is what the decoders in this tool target.

Glossary

Obfuscation

Transforming code so it still works but is hard for a person to read, usually by encoding strings and stripping formatting.

Hex escape (\xHH)

A way to write a character using two hexadecimal digits, for example \x41 for the letter A.

Unicode escape (\uHHHH)

A way to write a character using four hexadecimal digits of its unicode code point, for example \u0041 for A.

Percent encoding

URL-style encoding where a byte is written as a percent sign followed by two hex digits, such as %20 for a space.

String.fromCharCode

A JavaScript method that builds a string from a list of numeric character codes, often used to hide readable text.

Beautify

Reformatting compressed code by adding newlines and consistent indentation so its structure becomes visible.

Packer (eval-based obfuscation)

A format, popularized by Dean Edwards, that stores code as a compressed string and rebuilds it with a small decoder function wrapped in eval when the script runs.

Control-flow flattening

An obfuscation technique that replaces normal if and loop structures with a single dispatcher loop driven by a state variable, making the true execution order hard to see by reading the text.

Frequently asked questions

Sources

• String.fromCharCode() reference , MDN Web Docs
• decodeURIComponent() reference , MDN Web Docs