# javascript-deobfuscator

> General-purpose JavaScript deobfuscator for common obfuscation patterns, published on npm as js-deobfuscator and usable as a library or CLI. It unpacks arrays of literals and replaces references to them, removes simple, array and arithmetic proxy functions, simplifies arithmetic and string concatenation, removes dead branches, turns computed member access into static properties, renames hexadecimal identifiers such as _0xca830a and beautifies the result. The author also hosts an online version and maintains a separate deobfuscator for Obfuscator.io output.

- Type: Tool
- Targets: Website
- Category: Website analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/ben-sb/javascript-deobfuscator>
- Primary source: <https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/README.md>
- Catalog page: <https://awesomerea.org/resources/ben-sb-javascript-deobfuscator/>
- Record JSON: <https://awesomerea.org/resources/ben-sb-javascript-deobfuscator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ben-sb-javascript-deobfuscator/index.md)

## Requirements & limits

- npm release at review: js-deobfuscator 1.1.7, published 2025-07-15; the reviewed main commit is that version bump. No GitHub releases are published. The TypeScript package parses and regenerates code with the Shift parser and the author's shift-codegen fork; package.json declares no Node.js version range.
- Install it locally to import as a module, or globally for the js-deobfuscator CLI, which reads an input file and writes an output file, with -m for ES modules. The library config toggles each transformation. An online version runs at deobfuscate.io.
- Supply the JavaScript to analyze yourself. It handles the generic patterns listed in the README; for Obfuscator.io output the README points to the author's dedicated deobfuscator. Hexadecimal identifiers are replaced with names drawn from a bundled word list, not recovered originals, so output still needs analyst review.
- The LICENSE file is Apache-2.0, while package.json and the npm metadata declare ISC.

## Primary sources

1. <https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/README.md>
2. <https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/package.json>
3. <https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/src/config.ts>
4. <https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/src/modifications/renaming/variableRenamer.ts>
5. <https://github.com/ben-sb/javascript-deobfuscator/blob/4107a8a59d9a2267f921148cb33d3abf0bf6d128/LICENSE>
6. <https://www.npmjs.com/package/js-deobfuscator/v/1.1.7>

## More in Websites

- [mitmproxy2swagger](https://awesomerea.org/resources/mitmproxy2swagger/index.md) · Tool
- [JPEXS Free Flash Decompiler (FFDec)](https://awesomerea.org/resources/jpexs-decompiler/index.md) · Tool
- [WasmLens: exploratory WebAssembly inspection](https://awesomerea.org/resources/wasmlens/index.md) · Tool
- [synchrony](https://awesomerea.org/resources/synchrony/index.md) · Tool
- [sourcemapper](https://awesomerea.org/resources/sourcemapper/index.md) · Tool
- [ngrev](https://awesomerea.org/resources/ngrev/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.