So first of all, obfuscation is not security nor encryption. Obfuscation is usually used by big businesses with proprietary closed source software who dont want to share their code, and want to make it harder to read and understand. But there should be "javascript deobfuscation" tools online. Ive obfuscated and deobfuscated javascript before. I dont remember the websites, but its not too hard for a computer to do. Edit: I believe i used https://obfuscator.io/ to obfuscate and https://lelinhtinh.github.io/de4js/ to deobfuscate. But also keep in mind, if the obfuscated code you are looking at used something like Jscrambler, their proprietary techniques might make it hard to reverse. Answer from AngelLeatherist on reddit.com
🌐
Deobfuscate
deobfuscate.io
JavaScript Deobfuscator
A simple but powerful deobfuscator to remove common JavaScript obfuscation techniques
🌐
Reddit
reddit.com › r/javascript › [askjs] how to decode and understand javascript obfuscation correctly?
r/javascript on Reddit: [AskJS] How to decode and understand JavaScript obfuscation correctly?
August 17, 2022 -

Hi.

Recently I have started to learn about JS obfuscation in general across security researching and I was given a task by my instructor, he told me to enter this link (at nike.com) and try to understand what this script does, output, what it calls and basically remove all the obfuscation and decode it. I have tried to think of possible ways, using things I have found online to understand but I feel like its nearly impossible. Does anyone have any idea on how to even start and decode this? thank you

People also ask

What is JavaScript obfuscation?
JavaScript obfuscation is the process of transforming readable JS code into a difficult-to-understand form while preserving its functionality. Attackers use it to hide malicious payloads, and developers use it to protect intellectual property. Common techniques include Base64 encoding, hex/unicode escapes, eval() wrappers, and string concatenation.
🌐
mlab.sh
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | ...
Is this JS deobfuscator safe to use?
Yes. This tool runs 100% in your browser · no code is sent to any server. It performs static text transformations only and never executes the JavaScript being analyzed. Your data stays on your machine.
🌐
mlab.sh
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | ...
What obfuscation techniques does this tool support?
The tool supports: Base64 decoding (including multi-layer), hex string decoding (\x41), Unicode escapes (\u0041), octal escapes, String.fromCharCode(), eval/Function wrapper stripping, ROT13, URL defanging reversal (hxxps, [.], [at]), HTML entity decoding, unescape(), document.write stripping, and JSFuck detection.
🌐
mlab.sh
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | ...
🌐
Coderstoolbox
coderstoolbox.net › string
Online JavaScript string decoder
Encode and decode strings: Base64, URL, XML, JavaScript
🌐
MDN Web Docs
developer.mozilla.org › en-US › docs › Web › JavaScript › Reference › Global_Objects › decodeURI
decodeURI() - JavaScript | MDN
July 8, 2025 - The decodeURI() function decodes the URI by treating each escape sequence in the form %XX as one UTF-8 code unit (one byte). In UTF-8, the number of leading 1 bits in the first byte, which may be 0 (for 1-byte ASCII characters), 2, 3, or 4, indicates the number of bytes in the character.
🌐
Lapo
lapo.it › asn1js
ASN.1 JavaScript decoder
This page contains a JavaScript generic ASN.1 parser that can decode any valid ASN.1 DER or BER structure whether Base64-encoded (raw base64, PEM armoring and begin-base64 are recognized) or Hex-encoded.
🌐
MDN Web Docs
developer.mozilla.org › en-US › docs › Web › API › TextDecoder › decode
TextDecoder: decode() method - Web APIs | MDN
June 23, 2025 - The TextDecoder.decode() method returns a string containing text decoded from the buffer passed as a parameter.
Find elsewhere
🌐
MDN Web Docs
developer.mozilla.org › en-US › docs › Web › API › TextDecoder
TextDecoder - Web APIs | MDN
June 28, 2025 - The TextDecoder interface represents a decoder for a specific text encoding, such as UTF-8, ISO-8859-2, or GBK. A decoder takes an array of bytes as input and returns a JavaScript string.
🌐
Mlab
mlab.sh › home › tools › js & url deobfuscator
JS Deobfuscator Online · Decode Obfuscated JavaScript & URLs | mlab.sh
Free online JavaScript deobfuscator. Decode Base64, hex escapes, Unicode, String.fromCharCode, eval wrappers, ROT13, defanged URLs and more. 100% client-side, no data sent to any server.
🌐
Eric Meyer
meyerweb.com › eric › tools › dencoder
URL Decoder/Encoder
The URL Decoder/Encoder is licensed under a Creative Commons Attribution-ShareAlike 2.0 License.
🌐
DEV Community
dev.to › vladignatyev › decode-obfuscating-javascript-code-with-chatgpt-30ic
Decode obfuscated Javascript code with help of ChatGPT - DEV Community
June 2, 2024 - Please analyze the following code and tell me what it does? function _0x33bc(_0x357a49, _0x4d043b) { var _0x3af57c = _0x3af5(); return _0x33bc = function (_0x33bc59, _0x2d7f6b) { _0x33bc59 = _0x33bc59 - 0xac; var _0x433c74 = _0x3af57c[_0x33bc59]; return _0x433c74; }, _0x33bc(_0x357a49, _0x4d043b); } var _0x5b0965 = _0x33bc; function _0x3af5() { var _0x16d4f2 = ['2293120DDXwAC', '5tguhIh', 'ExpressJS', '32097acJbHr', '1234303tDdtZs', 'HTML', '51273EoArEE', 'CSS', 'JavaScript', '3214428qqnLuG', 'MongoDB', '40qdyzEo', 'Smith', '252346qcgJWs', '292cvJCiT', 'Anthony', 'PHP', '2392880xWQHuO',...
🌐
Jam
jam.dev › utilities › base-64-encoder
Base64 Encoder/Decoder | Free, Open Source & Ad-free
ASCII Decoding: Converts ASCII strings back to their original binary form, ensuring accurate data reconstruction. In JavaScript, Base64 encoding and decoding can be done using the built-in btoa and atob functions.
🌐
Telerik
telerik.com › blogs › encode-and-decode-strings-using-javascript
Encode and Decode strings using JavaScript
May 27, 2021 - In order for a string to be read from all computers sometimes it is useful to encode and decode it. This can be easily achieved using the JavaScript built-in es
🌐
W3Schools
w3schools.com › jsref › jsref_decodeuri.asp
JavaScript decodeURI() Method
❮ Previous JavaScript Global ... = encodeURI(uri); let decoded = decodeURI(encoded); Try it Yourself » · The decodeURI() method decodes a URI....
Top answer
1 of 3
9

Every obfuscated script needs some kind of eval. In here, the lines

_L = 'constr\x75\x63\x74\x6F\x72';
[][_L]_L)();

are doing this. _L is the string "constructor", and [].constructor.constructor is the Function constructor. It will be called with the decoded script, and the resulting function will be called. We can substitute it with an alert, paste the script in the console*, and wait for the result - we don't even need to understand how the decoding works. In your case, the result is (yes, including all the comments and linebreaks):

var alarm ="0";
var content = document;

if ((content.getElementById("wrapper") != null))
{
    document.getElementById('wrapper').style.display = 'block';
}

function a ()
{
    if ((content.getElementById("links") != null))
    {
        var temp = content.getElementById("links").innerHTML;
        if ((temp.indexOf('nofollow')+1) > 0)  alarm = "1";
        else if ((temp.indexOf('noindex')+1) > 0)  alarm = "1";
    }
    else alarm = "1";
}

function b ()
{
    if ((content.getElementById("aa") != null) && (content.getElementById("ab") != null))
    {
        temp = document.getElementById("aa").href;
        if ("http://uc-portaller.ru/" != temp) alarm = "1";

        temp = document.getElementById("ab").innerHTML;
        if ("скрипты для ucoz" != temp) alarm = "1";
    }
    else alarm = "1";
}

function c ()
{
    if ((content.getElementById("ba") != null) && (content.getElementById("bb") != null))
    {

        temp = content.getElementById("ba").href;
        if ("http://austere.ru/" != temp) alarm = "1";

        temp = content.getElementById("bb").innerHTML;
        if ("доска объявлений" != temp) alarm = "1";
    }
    else alarm = "1";
}

function d ()
{
    if ((content.getElementById("ca") != null) && (content.getElementById("cb") != null))
    {

        temp = content.getElementById("ca").href;
        if ("http://www.for-creative.com/" != temp) alarm = "1";

        temp = content.getElementById("cb").innerHTML;
        if ("темы для ucoz" != temp) alarm = "1";
    }
    else alarm = "1";
}

a ();

if (alarm == "0") b ();
if (alarm == "0") c ();
if (alarm == "0") d ();

if (alarm == "1") prompt('Нарушены условия использования, по всем вопросам обращайтесь в ICQ:', '376880395');












$(document).ready(function(){

    //When you click on a link with class of poplight and the href starts with a # 
    $('a.poplight[href^=#]').click(function() {
        var popID = $(this).attr('rel'); //Get Popup Name
        var popURL = $(this).attr('href'); //Get Popup href to define size

        //Pull Query & Variables from href URL
        var query= popURL.split('?');
        var dim= query[1].split('&');
        var popWidth = dim[0].split('=')[1]; //Gets the first query string value

        //Fade in the Popup and add close button
        $('#' + popID).fadeIn().css({ 'width': Number( popWidth ) }).prepend('');

        //Define margin for center alignment (vertical + horizontal) - we add 80 to the height/width to accomodate for the padding + border width defined in the css
        var popMargTop = ($('#' + popID).height() + 80) / 2;
        var popMargLeft = ($('#' + popID).width() + 80) / 2;

        //Apply Margin to Popup
        $('#' + popID).css({ 
            'margin-top' : -popMargTop,
            'margin-left' : -popMargLeft
        });

        //Fade in Background
        $('body').append('<div id="fade"></div>'); //Add the fade layer to bottom of the body tag.
        $('#fade').css({'filter' : 'alpha(opacity=0)'}).fadeIn(); //Fade in the fade layer 

        return false;
    });


    //Close Popups and Fade Layer
    $('a.close, #fade').live('click', function() { //When clicking on the close or fade layer...
        $('#fade , .popup_block').fadeOut(function() {
            $('#fade, a.close').remove();  
    }); //fade them both out

        return false;
    });


});




        $.fn.tabs = function () {
            return this.each(function () {
               var $tabwrapper = $(this); 

               var $panels = $tabwrapper.find('> div');
               var $tabs = $tabwrapper.find('> ul a');

               $tabs.click(function () {  
                   $tabs.removeClass('selected');
                   $(this).addClass('selected');

                   $panels
                    .hide() // hide ALL the panels
                    .filter(this.hash) // filter down to 'this.hash'
                        .show(); // show only this one

                   return false;
               }).filter(window.location.hash ? '[hash=' + window.location.hash + ']' : ':first').click();
            });
        };

        $(document).ready(function () {
            // console.log(window.location.hash);

            $('div.tabs').tabs();
        });

*) Of course you need to be sure what you're doing. There's always a small risk that it's a malicious script, and you might have not found all evals. @jfriend00's tip on executing the decoding snippets line-by-line is a safer way.

2 of 3
2

The only way I know of to understand what this code does is to find a safe environment (in case the code has malicious intent) and execute it line-by-line in a debugger and watch what it does as it deobfuscates itself to turn itself into normal javascript. The variable names will often stay obscured, but the giant string in _O will get decoded into something (probably javascript code).

🌐
Frontend Masters
frontendmasters.com › blog › encoding-and-decoding-urls-in-javascript
Encoding and Decoding URLs in JavaScript – Master.dev Blog
Decoding is important when you receive an encoded URL and need to extract information from it, similar to solving a puzzle in which you must decode to receive the message. In JavaScript, you can decode a URL using the decodeURIComponent() function.
🌐
Obfuscator
obfuscator.io
JavaScript obfuscator tool - Protect Your JS Code
Obfuscator.io is a powerful JavaScript obfuscator that protects your source code from theft and reverse engineering.
🌐
Script Asylum
scriptasylum.com › index › html & javascript encoder/decoder - script asylum
HTML & JavaScript Encoder/Decoder - Script Asylum
You can achieve the same thing by using the escape/un-escape & encoder/decoder functions above, but these are specialized to take out some of the guesswork. Each of the links below will open a new window. Javascript Encoder - Designed to encode Javascript only.