← All tools03 / STATIC SECURITY ANALYSIS

PowerShell
Deobfuscator.

Unpack the layers. Understand the clues.
Inspect suspicious commands without running them.

UNDERSTAND THE EVIDENCE

Less mystery.
More context.

Decode Base64, hex, and encoded text; expand gzip and deflate; reconstruct nested formatting, joins, reversed indexes, character arrays, literal XOR, and simple variable assignments. Inspect behavior indicators with the text that triggered each finding.

Privacy and analysis limits

Commands are processed locally in your browser. The analyzer does not execute commands, upload submitted text, or visit extracted URLs.

One analysis at a time, with a 5-second cooldown and 60 attempts per hour in this browser. Only usage timestamps are stored; the tool does not save command history. Downloading a report saves a local copy that may contain sensitive text.

32 KiB input, 256 KiB total candidate text, 24 candidate layers, 8 decoding levels, and a 3-second worker cutoff. No automatic retries.

What this cannot tell you

This is a static decoder, not a full PowerShell interpreter. Environment values, custom aliases, complex control flow, encrypted content, and remote payloads may prevent full reconstruction. The report identifies known blockers. Matches can occur in comments or strings; reconstructed candidates are not guaranteed to behave identically to the original. No report establishes that a command is safe.

PowerShellDeobfuscator.

Command analysis

PowerShell
Deobfuscator.