loading
Loading content
loading
Static Code Analysis
Batch deobfuscate JavaScript folders into readable source.
overview
javascript-deobfuscator rewrites obfuscated scripts toward readable source. It unpacks string-array lookups, inlines proxy functions, simplifies arithmetic and string concatenation, and renames hex identifiers.
The Trickest node takes one input-folder of scripts and writes a folder of cleaned files. That matches how crawlers dump bundles: point it at the dump, then grep or parse the output.
Use it when obfuscation blocks endpoint or secret extraction. It cleans code; it does not extract URLs or tokens. Chain jsluice or LinkFinder next. Prefer sourcemapper when source maps exist.
use cases
Run a folder of obfuscated scripts through the deobfuscator so the output reads like real source instead of encoded string arrays and proxy calls.
Deobfuscate first, then feed the readable files to LinkFinder or jsluice so the regex and parser stages see real URLs and paths, not hidden ones.
Unpack a script that hides its behavior behind obfuscation so you can read what it loads, calls, and exfiltrates at runtime.
Point the tool at a folder of bundles pulled by a crawler and let it process every file in one pass for a tree of legible output.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input-folder | FOLDER | · | Folder of JavaScript files to deobfuscate. Every file in the folder is processed and a cleaned copy is written to the output folder. |
Showing key inputs. javascript-deobfuscator exposes 1 inputs in total.
example
# batch-deobfuscate a folder of harvested scriptsfor f in ./js-bundles/*.js; do js-deobfuscator -i "$f" -o "./deobfuscated/$(basename "$f")"done// deobfuscated/collect.js (string array and proxy calls resolved)const config = { endpoint: "https://api.example.com/v2", timeout: 3000};function sendBeacon(payload) { return fetch(config.endpoint + "/collect", { method: "POST", body: JSON.stringify(payload) });}document.addEventListener("DOMContentLoaded", () => sendBeacon({ ref: document.referrer }));guidance
Use javascript-deobfuscator when harvested JS resists reading and you need legible source before analysis. It cleans code; it does not extract endpoints or secrets. Pair with jsluice or LinkFinder downstream. Use sourcemapper when maps are available.
Parses JavaScript for URLs and secrets. Run the deobfuscator first so jsluice sees readable code.
Regex endpoint discovery in JS. Deobfuscate first so endpoints are not hidden behind encoding.
Recovers original sources from source maps when they exist. Use maps when available; this tool when they are not.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
A folder of obfuscated JS bundles feeds javascript-deobfuscator, which rewrites them and writes a folder of readable files for analysis.
Facts on this page come from the live Trickest tool library.