Free. In your browser. Nothing uploaded.
Paste it. Decode it.
See what it really does.
Obfuscated JavaScript, a token you don't trust, a base64 blob in a config file, a header from a phishing mail. ghostkit works out what it is and runs the right tool, locally, on your machine.
Looks like . Ctrl+Enter to run. Detection happens as you type. Your paste never leaves this tab.
Run it here
The tools you reach for first.
Decode & deobfuscate
6 tools- JS Deobfuscator Decode hex, unicode, base64, String.fromCharCode, unpack arrays, unwrap eval(), all client-side in your browser.
- Encoder / Decoder Convert between Base64, Hex, URL encoding, HTML entities, Unicode escapes, and Octal. Auto-detect encoding format.
- JWT Decoder Decode and inspect JSON Web Tokens. View header, payload, claims, expiry status, and security warnings.
- SAML Decoder Decode base64-encoded SAML responses and assertions. View issuer, subject, attributes, conditions, and authentication context.
- Base64 Image Viewer Decode base64-encoded images and data URIs. Preview hidden images embedded in HTML, CSS, or JavaScript.
- QR Code Reader/Generator Generate QR codes from text or URLs with customizable error correction. Read and decode QR codes from uploaded images.
Inspect & analyze
14 tools- URL Analyzer Break down suspicious URLs into components, detect phishing indicators, check for homoglyphs, and defang for safe sharing.
- Email Headers Parse email headers to trace message routes, check SPF/DKIM/DMARC authentication, and detect spoofing indicators.
- CSP Analyzer Analyze Content-Security-Policy headers for risks. Detect unsafe-inline, unsafe-eval, wildcards, grade your policy A-F, and get fix suggestions.
- CORS Checker Analyze CORS response headers for misconfigurations. Detect wildcard origins, exposed headers, credential leaks, and preflight issues.
- Character Inspector Inspect text for homoglyphs, zero-width characters, mixed scripts, and invisible Unicode. Detect phishing and text manipulation.
- Cookie Analyzer Parse Set-Cookie headers and cookie strings. Check Secure, HttpOnly, SameSite flags, expiry, domain scope, and spot common misconfigurations.
- Entropy Analyzer Calculate Shannon entropy of text or files. Detect encrypted, compressed, or obfuscated data with byte frequency histograms.
- Hex Viewer View binary data as hex + ASCII with automatic file signature detection. Identify file types by magic bytes and inspect headers.
- EXIF Viewer Upload an image to extract EXIF metadata. View camera model, exposure settings, GPS coordinates, timestamps, and lens info. Flags privacy-sensitive location data.
- HTTP Response Inspector Paste raw HTTP responses to parse status, headers, and body. Flags missing security headers, info leaks, and misconfigurations.
- Certificate Decoder Decode PEM certificates to view subject, issuer, SANs, validity, key algorithm, and extensions. Check expiry and signature strength.
- CSR Decoder Decode PEM-encoded Certificate Signing Requests. View subject, key algorithm, key size, SANs, and requested extensions.
- DNS Lookup Resolve DNS records for any domain. Query A, AAAA, MX, TXT, NS, CNAME, SOA, and more. Detect mail provider, SPF, DMARC, and DKIM status.
- SSH Key Analyzer Parse SSH public and private keys. View key type, bit strength, fingerprints, encryption status, and security assessment.
Plus 19 more for formatting, hashing, keys and Web3 calldata. Every tool runs in your browser. Three of them (DNS lookup, CSR decoder, SSH key analyzer) call our server because the browser cannot do that work, and the page says so where it applies.
Find the right one
When the browser isn't enough.
obfuscator.io with control-flow flattening, an IonCube-encoded plugin, an extension with 400 files, a URL you'd rather detonate somewhere else. That is what the directory is for: 36 external tools, each with its limits, pricing and input caps written down so you don't find out the hard way.
Code Deobfuscation
8Tools for base64, eval chains, nested encoding, and string mangling.
PHP & WordPress Security
6Tools for plugin inspection, theme malware, and legacy PHP review.
Web Code Analysis
6Tools for JS payloads, mixed PHP/JS, and inline script inspection.
Browser Extension Analysis
3Tools for scanning and analyzing malicious browser extensions in Chrome, Firefox, and other browsers.
HTTP Traffic Interception
6Proxy tools for capturing, inspecting, and modifying HTTP/HTTPS traffic and API requests.
Email & Phishing Analysis
10Tools for analyzing email headers, detecting phishing attempts, and inspecting suspicious attachments.
Web3 Security
7Tools for auditing smart contracts, tracing blockchain transactions, detecting rug pulls, and monitoring DeFi protocols for threats and exploits.
Know what you're looking at
The technique behind the tool.
JavaScript Deobfuscation Techniques
How to deobfuscate JavaScript malware, phishing scripts, and browser exploits. Reverse eval packing, string rotation, array shuffling, and control flow flattening.
Tool: JS Deobfuscator
Unpacking eval() in Malicious JavaScript
How to unpack eval-wrapped JavaScript used in malware droppers, exploit kits, and obfuscated phishing scripts. Safe techniques for revealing hidden code.
Tool: JS Deobfuscator
PHP eval(base64_decode()) Malware Patterns
Identify and decode PHP webshells and backdoors that use eval(base64_decode()). Common patterns in WordPress hacks, file upload exploits, and server compromises.
Tool: Encoder / Decoder
JWT Token Analysis and Security Pitfalls
Decode and inspect JSON Web Tokens. Detect algorithm confusion attacks, missing signature verification, excessive claims, and insecure token storage.
Tool: JWT Decoder
Email Header Analysis
Parse email headers to trace message origin, verify SPF/DKIM/DMARC authentication, and detect spoofed sender addresses in phishing emails.
Tool: Email Headers
Detecting Phishing URLs: Indicators and Techniques
Analyze URLs for phishing indicators: typosquatting, homoglyph attacks, suspicious subdomains, URL shortener abuse, and credential harvesting parameters.
Tool: URL Analyzer
The thing you're decoding is usually the thing you least want to send to a stranger's server. So the toolkit doesn't. Decoders, the deobfuscator, the header analyzers, hashing, certificate parsing: all of it is plain JavaScript running in the tab you have open. Turn off wifi and it still works.
The directory is the other half. We don't pretend the browser handles everything. When it doesn't, the provider pages tell you which external tool does, what it costs, and where its limits are.
Start with the paste box at the top. That's the whole idea.