# JS Deobfuscator (kuizuo)

> Babel AST-based JavaScript deobfuscator with a CLI, a TypeScript API in the workspace package deob, and a browser playground built with Nuxt 3 and Monaco. It locates string-array decoders by array length, call count or analyst-supplied setup code and decoder names, evaluates them to inline the decoded strings, unflattens control flow, removes dead code and self-defending or anti-debug logic, merges object properties and renames mangled identifiers, repeating passes for heavily obfuscated input. The README credits webcrack as an inspiration, and its examples include javascript-obfuscator and jsjiami v6 output, the string-array style the catalog's obfuscator-io-deobfuscator entry also covers.

- Type: Tool
- Targets: Website
- Category: Website analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/kuizuo/js-deobfuscator>
- Primary source: <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/README.md>
- Catalog page: <https://awesomerea.org/resources/kuizuo-js-deobfuscator/>
- Record JSON: <https://awesomerea.org/resources/kuizuo-js-deobfuscator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/kuizuo-js-deobfuscator/index.md)

## Requirements & limits

- **Prerequisites:** From a clone, run pnpm install (workspace pins pnpm 11.21.0), then pnpm exec deob on a file or standard input, or pnpm tmp for tmp/input.js. The browser playground is at js-deobfuscator.vercel.app.
- **Limits:** Decoder code executes in isolated-vm with a 10-second timeout in Node; if that call fails, the code falls back to the host global eval. Process untrusted scripts in an isolated environment. Customized samples may require analyst-supplied setupCode and decoder names.
- **License:** The example directory includes obfuscated scripts and restored outputs; the repository gives no provenance or redistribution terms for those samples. The root LICENSE is MIT; packages/deob/package.json does not declare a license.

## Primary sources

1. <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/README.md>
2. <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/README.zh-CN.md>
3. <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/packages/deob/package.json>
4. <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/package.json>
5. <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/packages/deob/src/deobfuscate/vm.ts>
6. <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/website/utils/deobfuscate.worker.ts>
7. <https://github.com/kuizuo/js-deobfuscator/blob/21598ad5865a9e29b5c50c94f629a2e7528c7fbd/LICENSE>
8. <https://github.com/kuizuo/js-deobfuscator/releases/tag/v0.4.2>

## More in Websites

- [go-mitmproxy](https://awesomerea.org/resources/go-mitmproxy/index.md) · Tool
- [Dinosaur runner: recovering one acceleration rule](https://awesomerea.org/resources/rea-dinosaur-speed-case/index.md) · Case study
- [rauchg.com: rebuilding an RSC blog from captured Flight output](https://awesomerea.org/resources/rauchg-rsc-reconstruction-case/index.md) · Case study
- [BaoCut Slides: adapting an interactive web editor](https://awesomerea.org/resources/baocut-slides-editor-case/index.md) · Case study
- [REA in Claude Code: an isolated static-analysis A/B trial](https://awesomerea.org/resources/rea-claude-code-isolated-ab-case/index.md) · Case study
- [Dinosaur runner: an REA-inspected speed rule rebuilt with Codex](https://awesomerea.org/resources/rea-dino-runner-community-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.