# Obfuscator.io Deobfuscator

> Deobfuscator dedicated to JavaScript produced by Obfuscator.io (javascript-obfuscator), which its README says also handles most forks. Working statically on a Babel AST, it reveals strings hidden in rotated, Base64- or RC4-encoded string arrays, inlines proxy functions, simplifies objects, arithmetic and string concatenation, removes dead code and the obfuscator's anti-tamper wrappers, and reverses control-flow flattening. Its configuration is detected automatically, and the author also hosts an online version.

- Type: Tool
- Targets: Website
- Category: Website analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/ben-sb/obfuscator-io-deobfuscator>
- Primary source: <https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/README.md>
- Catalog page: <https://awesomerea.org/resources/obfuscator-io-deobfuscator/>
- Record JSON: <https://awesomerea.org/resources/obfuscator-io-deobfuscator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/obfuscator-io-deobfuscator/index.md)

## Requirements & limits

- npm release at review: obfuscator-io-deobfuscator 1.0.6, published 2025-03-27. The reviewed main commit, merged 2026-08-09, adds unreleased improvements to string-array wrapper identification and README notes on running the CLI from source; package.json still reports 1.0.6. No GitHub releases are published.
- Install the global obfuscator-io-deobfuscator CLI, which takes an input file and an optional output path, or build it from source with npm and TypeScript. It applies its Babel-based transformations repeatedly, for at most 50 passes; package.json declares no Node.js version range. An online version runs at obf-io.deobfuscate.io.
- Input must be JavaScript produced by Obfuscator.io or a compatible fork; other obfuscators are out of scope, and the author's general-purpose javascript-deobfuscator covers generic patterns. The README states that it does not run untrusted code or use a sandbox; recovered strings and control flow still need checking against the original script.
- The LICENSE file is Apache-2.0, while package.json and the npm metadata declare ISC.

## Primary sources

1. <https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/README.md>
2. <https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/package.json>
3. <https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/src/deobfuscator/deobfuscator.ts>
4. <https://github.com/ben-sb/obfuscator-io-deobfuscator/tree/42efc019d375f3cc266887ec36e929905836639c/src/deobfuscator/helpers/strings/decoders>
5. <https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/src/deobfuscator/transformations/antiTamper/antiTamperRemover.ts>
6. <https://github.com/ben-sb/obfuscator-io-deobfuscator/blob/42efc019d375f3cc266887ec36e929905836639c/LICENSE>
7. <https://github.com/ben-sb/obfuscator-io-deobfuscator/pull/52>
8. <https://www.npmjs.com/package/obfuscator-io-deobfuscator/v/1.0.6>

## More in Websites

- [javascript-deobfuscator](https://awesomerea.org/resources/ben-sb-javascript-deobfuscator/index.md) · Tool
- [mitmproxy2swagger](https://awesomerea.org/resources/mitmproxy2swagger/index.md) · Tool
- [JPEXS Free Flash Decompiler (FFDec)](https://awesomerea.org/resources/jpexs-decompiler/index.md) · Tool
- [WasmLens: exploratory WebAssembly inspection](https://awesomerea.org/resources/wasmlens/index.md) · Tool
- [synchrony](https://awesomerea.org/resources/synchrony/index.md) · Tool
- [sourcemapper](https://awesomerea.org/resources/sourcemapper/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.