🌐
Deobfuscate
deobfuscate.io
JavaScript Deobfuscator
A simple but powerful deobfuscator to remove common JavaScript obfuscation techniques
🌐
MDN Web Docs
developer.mozilla.org › en-US › docs › Web › API › TextDecoder › decode
TextDecoder: decode() method - Web APIs | MDN
June 23, 2025 - The TextDecoder.decode() method returns a string containing text decoded from the buffer passed as a parameter.
People also ask

What is JavaScript obfuscation?
JavaScript obfuscation is the process of transforming readable JS code into a difficult-to-understand form while preserving its functionality. Attackers use it to hide malicious payloads, and developers use it to protect intellectual property. Common techniques include Base64 encoding, hex/unicode escapes, eval() wrappers, and string concatenation.
🌐
mlab.sh
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | ...
Is this JS deobfuscator safe to use?
Yes. This tool runs 100% in your browser · no code is sent to any server. It performs static text transformations only and never executes the JavaScript being analyzed. Your data stays on your machine.
🌐
mlab.sh
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | ...
What obfuscation techniques does this tool support?
The tool supports: Base64 decoding (including multi-layer), hex string decoding (\x41), Unicode escapes (\u0041), octal escapes, String.fromCharCode(), eval/Function wrapper stripping, ROT13, URL defanging reversal (hxxps, [.], [at]), HTML entity decoding, unescape(), document.write stripping, and JSFuck detection.
🌐
mlab.sh
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | ...
🌐
Reddit
reddit.com › r/javascript › [askjs] how to decode and understand javascript obfuscation correctly?
r/javascript on Reddit: [AskJS] How to decode and understand JavaScript obfuscation correctly?
August 17, 2022 -

Hi.

Recently I have started to learn about JS obfuscation in general across security researching and I was given a task by my instructor, he told me to enter this link (at nike.com) and try to understand what this script does, output, what it calls and basically remove all the obfuscation and decode it. I have tried to think of possible ways, using things I have found online to understand but I feel like its nearly impossible. Does anyone have any idea on how to even start and decode this? thank you

🌐
Coderstoolbox
coderstoolbox.net › string
Online JavaScript string decoder
Encode and decode strings: Base64, URL, XML, JavaScript
🌐
MDN Web Docs
developer.mozilla.org › en-US › docs › Web › JavaScript › Reference › Global_Objects › decodeURI
decodeURI() - JavaScript | MDN
The decodeURI() function decodes the URI by treating each escape sequence in the form %XX as one UTF-8 code unit (one byte). In UTF-8, the number of leading 1 bits in the first byte, which may be 0 (for 1-byte ASCII characters), 2, 3, or 4, indicates the number of bytes in the character.
🌐
MDN Web Docs
developer.mozilla.org › en-US › docs › Web › API › TextDecoder
TextDecoder - Web APIs | MDN
June 28, 2025 - The TextDecoder interface represents a decoder for a specific text encoding, such as UTF-8, ISO-8859-2, or GBK. A decoder takes an array of bytes as input and returns a JavaScript string.
🌐
JavaScript Deobfuscator
deobfuscate.relative.im
JavaScript Deobfuscator
A simple deobfuscator for mangled or obfuscated JavaScript files view on GitHub · Deobfuscate Save ·
Find elsewhere
🌐
Mlab
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | mlab.sh
Free client-side JavaScript and URL deobfuscation tool. Supports Base64, hex, Unicode, eval unwrapping, ROT13, defanged IOCs and more.
🌐
Lapo
lapo.it › asn1js
ASN.1 JavaScript decoder
This page contains a JavaScript generic ASN.1 parser that can decode any valid ASN.1 DER or BER structure whether Base64-encoded (raw base64, PEM armoring and begin-base64 are recognized) or Hex-encoded.
🌐
GitHub
github.com › kuizuo › js-deobfuscator
GitHub - kuizuo/js-deobfuscator: An automated JavaScript deobfuscation tool based on Babel AST, with an online playground, CLI, and programmable API. · GitHub
An automated JavaScript deobfuscation tool based on Babel AST, with an online playground, CLI, and programmable API. - kuizuo/js-deobfuscator
Author: kuizuo
🌐
Eric Meyer
meyerweb.com › eric › tools › dencoder
URL Decoder/Encoder
The URL Decoder/Encoder is licensed under a Creative Commons Attribution-ShareAlike 2.0 License.
🌐
Jam
jam.dev › utilities › base-64-encoder
Base64 Encoder/Decoder | Free, Open Source & Ad-free
ASCII Decoding: Converts ASCII strings back to their original binary form, ensuring accurate data reconstruction. In JavaScript, Base64 encoding and decoding can be done using the built-in btoa and atob functions.
🌐
Telerik
telerik.com › blogs › encode-and-decode-strings-using-javascript
Encode and Decode strings using JavaScript
May 27, 2021 - In order for a string to be read from all computers sometimes it is useful to encode and decode it. This can be easily achieved using the JavaScript built-in escape() and unescape() methods.
🌐
W3Schools
w3schools.com › jsref › jsref_decodeuri.asp
JavaScript decodeURI() Method
❮ Previous JavaScript Global ... decoded = decodeURI(encoded); Try it Yourself » · Share Link Copied · The decodeURI() method decodes a URI....
Top answer
1 of 3
9

Every obfuscated script needs some kind of eval. In here, the lines

_L = 'constr\x75\x63\x74\x6F\x72';
[][_L]_L)();

are doing this. _L is the string "constructor", and [].constructor.constructor is the Function constructor. It will be called with the decoded script, and the resulting function will be called. We can substitute it with an alert, paste the script in the console*, and wait for the result - we don't even need to understand how the decoding works. In your case, the result is (yes, including all the comments and linebreaks):

var alarm ="0";
var content = document;

if ((content.getElementById("wrapper") != null))
{
    document.getElementById('wrapper').style.display = 'block';
}

function a ()
{
    if ((content.getElementById("links") != null))
    {
        var temp = content.getElementById("links").innerHTML;
        if ((temp.indexOf('nofollow')+1) > 0)  alarm = "1";
        else if ((temp.indexOf('noindex')+1) > 0)  alarm = "1";
    }
    else alarm = "1";
}

function b ()
{
    if ((content.getElementById("aa") != null) && (content.getElementById("ab") != null))
    {
        temp = document.getElementById("aa").href;
        if ("http://uc-portaller.ru/" != temp) alarm = "1";

        temp = document.getElementById("ab").innerHTML;
        if ("скрипты для ucoz" != temp) alarm = "1";
    }
    else alarm = "1";
}

function c ()
{
    if ((content.getElementById("ba") != null) && (content.getElementById("bb") != null))
    {

        temp = content.getElementById("ba").href;
        if ("http://austere.ru/" != temp) alarm = "1";

        temp = content.getElementById("bb").innerHTML;
        if ("доска объявлений" != temp) alarm = "1";
    }
    else alarm = "1";
}

function d ()
{
    if ((content.getElementById("ca") != null) && (content.getElementById("cb") != null))
    {

        temp = content.getElementById("ca").href;
        if ("http://www.for-creative.com/" != temp) alarm = "1";

        temp = content.getElementById("cb").innerHTML;
        if ("темы для ucoz" != temp) alarm = "1";
    }
    else alarm = "1";
}

a ();

if (alarm == "0") b ();
if (alarm == "0") c ();
if (alarm == "0") d ();

if (alarm == "1") prompt('Нарушены условия использования, по всем вопросам обращайтесь в ICQ:', '376880395');












$(document).ready(function(){

    //When you click on a link with class of poplight and the href starts with a # 
    $('a.poplight[href^=#]').click(function() {
        var popID = $(this).attr('rel'); //Get Popup Name
        var popURL = $(this).attr('href'); //Get Popup href to define size

        //Pull Query & Variables from href URL
        var query= popURL.split('?');
        var dim= query[1].split('&');
        var popWidth = dim[0].split('=')[1]; //Gets the first query string value

        //Fade in the Popup and add close button
        $('#' + popID).fadeIn().css({ 'width': Number( popWidth ) }).prepend('');

        //Define margin for center alignment (vertical + horizontal) - we add 80 to the height/width to accomodate for the padding + border width defined in the css
        var popMargTop = ($('#' + popID).height() + 80) / 2;
        var popMargLeft = ($('#' + popID).width() + 80) / 2;

        //Apply Margin to Popup
        $('#' + popID).css({ 
            'margin-top' : -popMargTop,
            'margin-left' : -popMargLeft
        });

        //Fade in Background
        $('body').append('<div id="fade"></div>'); //Add the fade layer to bottom of the body tag.
        $('#fade').css({'filter' : 'alpha(opacity=0)'}).fadeIn(); //Fade in the fade layer 

        return false;
    });


    //Close Popups and Fade Layer
    $('a.close, #fade').live('click', function() { //When clicking on the close or fade layer...
        $('#fade , .popup_block').fadeOut(function() {
            $('#fade, a.close').remove();  
    }); //fade them both out

        return false;
    });


});




        $.fn.tabs = function () {
            return this.each(function () {
               var $tabwrapper = $(this); 

               var $panels = $tabwrapper.find('> div');
               var $tabs = $tabwrapper.find('> ul a');

               $tabs.click(function () {  
                   $tabs.removeClass('selected');
                   $(this).addClass('selected');

                   $panels
                    .hide() // hide ALL the panels
                    .filter(this.hash) // filter down to 'this.hash'
                        .show(); // show only this one

                   return false;
               }).filter(window.location.hash ? '[hash=' + window.location.hash + ']' : ':first').click();
            });
        };

        $(document).ready(function () {
            // console.log(window.location.hash);

            $('div.tabs').tabs();
        });

*) Of course you need to be sure what you're doing. There's always a small risk that it's a malicious script, and you might have not found all evals. @jfriend00's tip on executing the decoding snippets line-by-line is a safer way.

2 of 3
2

The only way I know of to understand what this code does is to find a safe environment (in case the code has malicious intent) and execute it line-by-line in a debugger and watch what it does as it deobfuscates itself to turn itself into normal javascript. The variable names will often stay obscured, but the giant string in _O will get decoded into something (probably javascript code).

🌐
Frontend Masters
frontendmasters.com › blog › encoding-and-decoding-urls-in-javascript
Encoding and Decoding URLs in JavaScript – Master.dev Blog
Decoding is important when you receive an encoded URL and need to extract information from it, similar to solving a puzzle in which you must decode to receive the message. In JavaScript, you can decode a URL using the decodeURIComponent() function.