Static Code Analysis
Turn obfuscated JavaScript folders into readable source
Batch deobfuscate JavaScript folders into readable source.
overview
What javascript-deobfuscator does
javascript-deobfuscator rewrites obfuscated scripts toward readable source. It unpacks string-array lookups, inlines proxy functions, simplifies arithmetic and string concatenation, and renames hex identifiers.
The Trickest node takes one input-folder of scripts and writes a folder of cleaned files. That matches how crawlers dump bundles: point it at the dump, then grep or parse the output.
Use it when obfuscation blocks endpoint or secret extraction. It cleans code; it does not extract URLs or tokens. Chain jsluice or LinkFinder next. Prefer sourcemapper when source maps exist.
use cases
Where javascript-deobfuscator fits
Make a minified bundle readable
Run a folder of obfuscated scripts through the deobfuscator so the output reads like real source instead of encoded string arrays and proxy calls.
Prep JS for endpoint extraction
Deobfuscate first, then feed the readable files to LinkFinder or jsluice so the regex and parser stages see real URLs and paths, not hidden ones.
Analyze suspicious client-side code
Unpack a script that hides its behavior behind obfuscation so you can read what it loads, calls, and exfiltrates at runtime.
Batch-clean a crawl's script dump
Point the tool at a folder of bundles pulled by a crawler and let it process every file in one pass for a tree of legible output.
reference
javascript-deobfuscator inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-folder | FOLDER | · | Folder of JavaScript files to deobfuscate. Every file in the folder is processed and a cleaned copy is written to the output folder. |
Showing key inputs. javascript-deobfuscator exposes 1 inputs in total.
example
Run javascript-deobfuscator
# batch-deobfuscate a folder of harvested scriptsfor f in ./js-bundles/*.js; do js-deobfuscator -i "$f" -o "./deobfuscated/$(basename "$f")"done// deobfuscated/collect.js (string array and proxy calls resolved)const config = { endpoint: "https://api.example.com/v2", timeout: 3000};function sendBeacon(payload) { return fetch(config.endpoint + "/collect", { method: "POST", body: JSON.stringify(payload) });}document.addEventListener("DOMContentLoaded", () => sendBeacon({ ref: document.referrer }));guidance
Choosing javascript-deobfuscator
Use javascript-deobfuscator when harvested JS resists reading and you need legible source before analysis. It cleans code; it does not extract endpoints or secrets. Pair with jsluice or LinkFinder downstream. Use sourcemapper when maps are available.
jsluice
Parses JavaScript for URLs and secrets. Run the deobfuscator first so jsluice sees readable code.
LinkFinder
Regex endpoint discovery in JS. Deobfuscate first so endpoints are not hidden behind encoding.
sourcemapper
Recovers original sources from source maps when they exist. Use maps when available; this tool when they are not.
faq
javascript-deobfuscator questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run javascript-deobfuscator yourself
A folder of obfuscated JS bundles feeds javascript-deobfuscator, which rewrites them and writes a folder of readable files for analysis.
Facts on this page come from the live Trickest tool library.