Home/Code Deobfuscator

💉 Code Deobfuscator & Analyzer

Paste obfuscated JavaScript, Python, or PHP to detect malicious patterns, extract embedded URLs/IPs, and run AI deep analysis to understand what the code actually does. Used for malware analysis and CTF challenges.

Deobfuscate Malicious Code, Extract IOCs, and Analyze Obfuscation Techniques

Code Deobfuscator is a security tool for analyzing obfuscated JavaScript, PowerShell, Python, PHP, and other scripting languages commonly used in malware, phishing kits, and web shells. Paste obfuscated code and the tool applies multiple deobfuscation techniques to reveal the underlying logic, extract embedded Indicators of Compromise (IOCs) like URLs, IP addresses, and file hashes, and identify the obfuscation pattern used.

Malicious code is almost universally obfuscated to evade signature-based detection. Common JavaScript techniques include hex and Unicode encoding, string concatenation with eval(), multiple layers of base64 encoding, and variable renaming. PowerShell malware favors base64-encoded commands, character substitution, and environment variable concatenation. The deobfuscator recognizes and reverses these patterns automatically.

The IOC extraction panel pulls all suspicious strings from the deobfuscated output: URLs, domain names, IP addresses, file paths, registry keys, and cryptographic hashes. These can be immediately checked against threat intelligence databases to determine whether the code is associated with known malware families.

⚡ How to Use

  1. 1Paste the obfuscated code into the input panel.
  2. 2Select the language if known, or leave on "Auto-detect".
  3. 3Click "Deobfuscate" — the tool applies all relevant techniques in sequence.
  4. 4Review the deobfuscated output in the right panel.
  5. 5Check the IOC tab for extracted network indicators and file artifacts.

🎯 Who Uses This

  • ▸Malware analysts reverse-engineering obfuscated malicious scripts
  • ▸Incident responders examining suspicious scripts found during investigations
  • ▸SOC analysts triaging potentially malicious email attachments
  • ▸Bug bounty hunters analyzing obfuscated client-side code on web applications
  • ▸Web developers auditing third-party scripts for malicious injection

Frequently Asked Questions

Q: Can it deobfuscate all types of obfuscation?
The tool handles many common patterns but obfuscation is an arms race. Heavily layered obfuscation, VM-based protectors (like Themida), and custom encoding schemes may require manual analysis beyond what automated tools can provide. The tool is most effective on malware-grade obfuscation rather than commercial code protection.
Q: Is it safe to paste malicious code here?
Yes. The code is analyzed as text — it is never executed. All processing is done locally in your browser's JavaScript engine. No pasted code runs, no network requests are made based on the code content, and nothing is stored.