How to unobfuscate javascript

Website Array · Tags

A lot of javascript gets packed up these days with Dean Edwards’ amazing Packer functionality. This is great for delivery and optimization, but hard for people to make minor adjustments or to just peak at the code to learn some new techniques. It’s also quite frustrating if you just want to tweak a bit of code you just purchased, but the original author doesn’t reply to your inquiries. So here’s a short and simple way to turn/decode “packed” javascript into plain readable javascript.

  1. Bookmark the following javascript link so you can run it from any site: Enable Decode Button
  2. Now go to the packer website and click the bookmarked link you just created. The “copy” text area should now be writable and the decode button activated. Now copy in your packed and obfuscated code and hit decode.
  3. At this point you pretty much have what you need, but for better legibility head over here, paste your decoded code in and hit beautify.

After you’re done making changes it’s probably best to pack the code again, because it does have its advantages (a much smaller file size for example).

Happy coding!

  • Facebook
  • Twitter
  • Digg
  • StumbleUpon
  • Technorati
  • Reddit
  • RSS
  • email

Previous post:
Next post:

9 Responses to “How to unobfuscate javascript”

  1. p says:

    Obsolete, dead links, doesn’t work.

  2. Mike Postma says:

    Thanks for letting me know. I’ve updated the “beautify” link.

  3. BRN says:

    Got the form with the “copy” area writtable and “decode” button activated, but after pasting single testing obfuscated line of code it says:

    error decoding script: Stringnf is not defined

    Am I doing something wrong?

    Line I am trying if this:‘\x64\x77\x5f\x49\x6e\x66\x2e\x67\x65\x74\x28\x64\x77\x5f\x49\x6e\x66\x2e\x61\x72\x29’);

  4. Mike Postma says:

    This particular tutorial is only meant to decode Javascript which has been obfuscated by Dean Edwards’ Packer. Packer-encoded scripts start with: eval(function(p,a,c,k,e,d){e=function(c){ etc.

    The line of code you’re trying to decode is encoded a little differently. However, it’s simple to decode. Just wrap the entire thing in a console.log(“”) statement and the script in plain text is printed to the console as:‘dw_Inf.get(′);

  5. Eric says:

    Hi Mike,
    How could i change the word, instead of using the p,a,c,k,e,d word, how can i change it to be something different? Do you know all the variables inside the packed.js i should change to achieve this? I’ve tried changing all the variables but i only get an ‘c not defined’

  6. Mike Postma says:

    You could “simply” replace all the variables throughout the code.. It’s tedious work, but it’s possible. I made a simple jsfiddle to show you this: The packed js code is: $(‘p’).html(‘Success’);​​​​​

  7. Paul Anthony Webb says:

    This is pretty friggin’ great. Thanks a lot for this!

  8. Stephen says:

    It seems to ‘run’ the decoded script, as apposed to just generate the output. This is not desired. Can you make it decode without running?

  9. Mike Postma says:

    Which step is running the code? Make sure that for step 2 you paste the packed code in the bottom text area.

Leave a Comment

(required) (required)