JavaScript deobfuscators compared:
which tool undoes which obfuscation
A JavaScript deobfuscator is a tool that rewrites obfuscated JavaScript into code a person can read. In November 2026, six free tools cover the common cases: webcrack, synchrony, REstringer, deobfuscate.io, de4js and js-beautify. Each one handles different obfuscation techniques, and none of them can read JavaScript that has been virtualized into bytecode.
This guide compares the six tools, matches each common obfuscation technique to the tool that undoes it, and explains how to run them safely on a malicious script. It ends with the case they all miss, and what recovering that code takes. It is written for analysts and developers working on code they own or are authorized to assess.
What does a JavaScript deobfuscator do?
A JavaScript deobfuscator reverses the changes an obfuscator made to a script’s text while keeping its behavior the same. Most deobfuscators parse the script into a syntax tree, apply transforms such as decoding a string array or removing a wrapper function, and print the result as cleaner JavaScript. The script is not run as a whole, although some tools evaluate small pieces of it to recover values.
The usual targets are the four that deobfuscate.io’s documentation lists: strings moved into an array and replaced with lookups, calls routed through proxy functions, arithmetic and concatenation that hide simple values, and identifiers renamed to hex strings. HUMAN Security’s write-up on REstringer walks through the first of them step by step. Undo those four and most obfuscated scripts read like ordinary code again.
Six JavaScript deobfuscators at a glance
The six JavaScript deobfuscators below are free and open source. They differ in which obfuscator they target, how you run them and whether they are still maintained.
| Tool | What it handles | How you run it | Status |
|---|---|---|---|
| webcrack | obfuscator.io output, minified code, webpack and browserify bundles (unpacks them into modules) | Command line, Node.js library or online playground | Active |
| synchrony | javascript-obfuscator and obfuscator.io output, with an automatic string decoder | Command line (npm package “deobfuscator”) or online | Active |
| REstringer | Reconstructs strings, removes dead code and simplifies control flow; detects the obfuscation type first | Command line or Node.js module | Active (HUMAN Security) |
| deobfuscate.io | String and literal arrays, proxy functions, arithmetic and string concatenation, hex identifier names | Online, or the npm package js-deobfuscator | Active |
| de4js | Eval packers, array obfuscators, URL encoding, JSFuck, JJencode and AAencode | In the browser, offline | Archived repository |
| js-beautify | Re-indents minified code, unpacks Dean Edwards’ packer, partly deobfuscates javascript-obfuscator output | Command line, library or beautifier.io | Active |
Each project documents its scope in its repository: webcrack, synchrony, REstringer, deobfuscate.io, de4js and js-beautify. js-beautify is on the list because people often reach for it first. It is mainly a formatter: it re-indents code, unpacks Dean Edwards’ packer and only partly deobfuscates javascript-obfuscator output.
Which deobfuscator handles obfuscator.io output?
webcrack and synchrony are the two deobfuscators built mainly for obfuscator.io, the hosted version of the open-source javascript-obfuscator project. webcrack also unminifies code and unpacks webpack and browserify bundles into separate modules, which makes it the first tool to try on a bundled front-end script. synchrony decodes strings automatically and needs no configuration.
Both have limits. synchrony’s documentation warns that output from old javascript-obfuscator releases will likely not deobfuscate correctly, and suggests trying an earlier synchrony release or another tool. deobfuscate.io’s author keeps a separate project dedicated to obfuscator.io and describes the main tool as general purpose. When one deobfuscator stalls on an obfuscator.io script, running a second one over its output often finishes the job.
Which tool for which obfuscation technique?
The right JavaScript deobfuscator depends on the technique in front of you, so identify the technique first. The table maps the common techniques to the tools whose documentation says they handle them.
| Technique | Tools that undo it |
|---|---|
| Encoded strings in an array | webcrack, synchrony, REstringer, deobfuscate.io |
| Proxy and wrapper functions | deobfuscate.io |
| Hex identifier names such as _0x4f2a | deobfuscate.io (renames them) |
| Dead code and convoluted control flow | REstringer |
| Minified, single-line code | webcrack (unminify), js-beautify (format only) |
| webpack or browserify bundles | webcrack |
| Eval packers, JSFuck, JJencode, AAencode | de4js; js-beautify for Dean Edwards’ packer |
| Virtualized code: bytecode plus an interpreter | None of them: needs interpreter analysis |
A script usually stacks several techniques. A typical order is to unpack or unminify first, run a syntax-tree deobfuscator for strings and wrappers, and format the result last. de4js covers the older encodings such as JSFuck, JJencode and AAencode, and its repository is archived, so treat it as a tool for legacy scripts.
Is it safe to run a JavaScript deobfuscator on malicious code?
Running a JavaScript deobfuscator on a malicious script is safe only in an isolated environment. Some deobfuscators evaluate parts of the code to recover strings and other values. REstringer runs its unsafe modules inside an isolated-vm sandbox, and webcrack depends on isolated-vm as well. A sandbox inside the tool lowers the risk; it does not replace a disposable analysis machine.
- Keep samples off production machines. Analyze malicious scripts in a virtual machine with no route to internal networks.
- Check where online versions send the code. Pasting a client’s script or a confidential bundle into a website shares it with that site. Use the command-line version when the code is not yours to share.
- Keep the original. Deobfuscation rewrites the file. Store the sample and its hash before you transform it, so findings can be traced back.
Malware analysts who handle skimmers and droppers on their own or a client’s systems can read more in devirtualization for malware analysts.
Why can’t deobfuscators read virtualized JavaScript?
Virtualized JavaScript defeats text-rewriting deobfuscators because the protected functions no longer exist as JavaScript. An obfuscator compiles them into custom bytecode for a small interpreter shipped inside the script. What a deobfuscator sees is a dispatcher that reads opcodes from a data blob and calls short handler functions, so the logic lives in the bytecode, not in the code the tool rewrites.
Obfuscators can also regenerate the interpreter for every build, so an instruction set worked out for one script does not carry over to the next. Recovering the logic means analyzing the interpreter and mapping its opcodes back to readable code. That is a different job from deobfuscation, and our comparison of devirtualization, deobfuscation and unpacking sets out where each one applies.
Devirt’s JavaScript VM deobfuscation handles that case for scripts you own or are authorized to assess, such as malicious scripts and front-end security reviews. The result explains what the virtualized code does, and its coverage ledger separates proven logic from behavior that depends on the page, the browser or data fetched at run time, which is reported as runtime-dependent rather than proven. Devirt does not help bypass bot protection, anti-fraud systems or access controls, scrape websites or evade detection.
Questions about JavaScript deobfuscators
What is the difference between obfuscation and minification?
Minification shrinks JavaScript by removing whitespace and shortening names, while obfuscation deliberately makes code hard to understand through encoded strings, proxy functions and convoluted control flow. A beautifier such as js-beautify reverses most of what minification does to layout. Obfuscation needs a deobfuscator, and virtualization needs analysis of the interpreter.
Is it legal to deobfuscate JavaScript?
Whether deobfuscating JavaScript is legal depends on the jurisdiction, the license and the purpose. Security research, malware analysis and interoperability are common reasons people deobfuscate code they own or are authorized to assess. Devirt’s acceptable use policy sets out what it accepts. This is general information, not legal advice.
Should I use an online deobfuscator or a local one?
An online JavaScript deobfuscator is quicker for a public script, and a local one is safer for anything confidential or malicious. webcrack, synchrony and deobfuscate.io offer both, so the same tool can run in a browser for a quick look and on an isolated machine for real samples. For an AI tool’s take on decompiled code, see what AI decompilers recover.
If a script is virtualized and you need its logic, start with a free assessment. Devirt reviews the script, states the scope and estimated coverage in a written offer, and nothing is charged unless you accept it.