UnPHP

online Free

www.unphp.net

Quick Facts

Open Source

Yes

Platforms

web

API Available

no

Account

Required

Skill Level

beginner

Offline Capable

Yes

Output Formats

txt

Max Input Size

1MB

What it does

Automatically decodes PHP files using common obfuscation techniques. Handles eval(), gzinflate(), str_rot13(), str_replace(), base64_decode(), and preg_replace() combinations. Performs recursive deobfuscation through multiple nested layers—tested with 81 rounds of eval + base64. Supports custom decoder functions and regex patterns.

When to use it

Decoding PHP malware samples
Analyzing obfuscated WordPress infections
Quick eval/base64 chain decoding
When decodephp.io is overkill

When not to use it

IonCube/Zend Guard encoded files
Non-PHP code
Custom/novel obfuscation techniques

Limitations

Limited to known obfuscation patterns
No IonCube/commercial encoder support
May fail on heavily customized obfuscation

Frequently Asked Questions

Is UnPHP free to use?

Yes, UnPHP is completely free to use with no subscription required.

What is the file size limit for UnPHP?

The maximum file size for UnPHP is 1MB. This limit applies to the free version.

What platforms does UnPHP support?

UnPHP is available on Web (browser).

Does UnPHP require an account?

No, UnPHP does not require an account. You can use it without signing up.

Is UnPHP open source?

Yes, UnPHP is open source.

What are the limitations of UnPHP?

Limited to known obfuscation patterns No IonCube/commercial encoder support May fail on heavily customized obfuscation

What does UnPHP do?

UnPHP is a web-based tool for code deobfuscation, php & wordpress security. Automatically decodes PHP files using common obfuscation techniques. Handles eval(), gzinflate(), str_rot13(), str_replace(), base64_decode(), and preg_replace() combinations. Performs recursive deobf

Related Tools

CyberChef Free

The cyber Swiss Army knife. Drag-and-drop operations into recipes for encoding, decoding, encryption, and data analysis—all in your browser.

DecodePHP

Professional IonCube decoder supporting versions 10 through 15 with PHP 7.1 to 8.4. Upload encrypted PHP files and get readable source code back.

GhostKit Free

A curated directory and browser-based toolkit for security researchers. GhostKit combines 14+ client-side tools — JS deobfuscation, encoding/decoding, URL analysis, email header parsing, hash generation, JWT/SAML decoding, and more — with a comprehensive directory of external security tools.

de4js Free

Browser-based JavaScript deobfuscator supporting 15+ formats including JSFuck, obfuscator.io, and packed code.