Tool

JS Deobfuscator (kuizuo)

Babel AST-based JavaScript deobfuscator with a CLI, a TypeScript API in the workspace package deob, and a browser playground built with Nuxt 3 and Monaco. It locates string-array decoders by array length, call count or analyst-supplied setup code and decoder names, evaluates them to inline the decoded strings, unflattens control flow, removes dead code and self-defending or anti-debug logic, merges object properties and renames mangled identifiers, repeating passes for heavily obfuscated input. The README credits webcrack as an inspiration, and its examples include javascript-obfuscator and jsjiami v6 output, the string-array style the catalog's obfuscator-io-deobfuscator entry also covers.

Targets: Website
Category: Website analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-10-27

Stars: 1.2k
Last commit: 2026-11-08
Language: JavaScript
License (GitHub): MIT

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Prerequisites: From a clone, run pnpm install (workspace pins pnpm 11.21.0), then pnpm exec deob on a file or standard input, or pnpm tmp for tmp/input.js. The browser playground is at js-deobfuscator.vercel.app.
Limits: Decoder code executes in isolated-vm with a 10-second timeout in Node; if that call fails, the code falls back to the host global eval. Process untrusted scripts in an isolated environment. Customized samples may require analyst-supplied setupCode and decoder names.
License: The example directory includes obfuscated scripts and restored outputs; the repository gives no provenance or redistribution terms for those samples. The root LICENSE is MIT; packages/deob/package.json does not declare a license.

Cite

BibTeX

@misc{kuizuo-js-deobfuscator,
  title = {{JS Deobfuscator (kuizuo)}},
  howpublished = {\url{https://github.com/kuizuo/js-deobfuscator}},
  url = {https://github.com/kuizuo/js-deobfuscator},
  urldate = {2026-10-27},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/kuizuo-js-deobfuscator/}}
}

Plain text

JS Deobfuscator (kuizuo). https://github.com/kuizuo/js-deobfuscator (accessed 2026-10-27). Awesome REA entry: https://awesomerea.org/resources/kuizuo-js-deobfuscator/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · kuizuo/js-deobfuscator · Revision 21598ad
README.zh-CN.md GitHub · kuizuo/js-deobfuscator · Revision 21598ad
packages/deob/package.json GitHub · kuizuo/js-deobfuscator · Revision 21598ad
package.json GitHub · kuizuo/js-deobfuscator · Revision 21598ad
packages/deob/src/deobfuscate/vm.ts GitHub · kuizuo/js-deobfuscator · Revision 21598ad
website/utils/deobfuscate.worker.ts GitHub · kuizuo/js-deobfuscator · Revision 21598ad
LICENSE GitHub · kuizuo/js-deobfuscator · Revision 21598ad
https://github.com/kuizuo/js-deobfuscator/releases/tag/v0.4.2