Web Code Analysis
Tools for JS payloads, mixed PHP/JS, and inline script inspection.
GhostKit
onlineghostkit.net
A curated directory and browser-based toolkit for security researchers. GhostKit combines 14+ client-side tools — JS deobfuscation, encoding/decoding, URL analysis, email header parsing, hash generation, JWT/SAML decoding, and more — with a comprehensive directory of external security tools.
Tools
CyberChef
The cyber Swiss Army knife. Drag-and-drop operations into recipes for encoding, decoding, encryption, and data analysis—all in your browser.
de4js
Browser-based JavaScript deobfuscator supporting 15+ formats including JSFuck, obfuscator.io, and packed code.
Hybrid Analysis
Free malware sandbox powered by CrowdStrike Falcon. Upload files up to 250MB for behavioral analysis and threat detection.
VirusTotal
Scan files and URLs against 70+ antivirus engines. The definitive multi-engine malware check.
URLScan.io
A sandbox for the web. Scan URLs and see every request, cookie, and DOM element—with screenshots from 20+ countries.