JavaScript eval Packer: Unpack and Pack
EncodingEverything runs locally in your browser — nothing is uploaded
Handles the Dean Edwards packer — the `eval(function(p,a,c,k,e,d){…})` construct. It replaces words that recur in the source (`function`, `document`, `length`…) with short names, stores the compressed body as one string, and appends the lookup table. ⚠️ It is not encryption: there is no key, the table sits right there in the code, and unpacking needs nothing beyond it. The format spread widely — plenty of sites use it as "light obfuscation" — and it happens to be one of the easiest to reverse.
Features
- Unpack: turn `eval(function(p,a,c,k,e,d){…})` back into readable source
- Pack: generate the same format, with an adjustable radix (2–62)
- ⚠️ Pure string manipulation — no JavaScript is executed
- Single quotes, escapes and line breaks inside the payload all parse correctly
- Replacement runs from the largest index down, so tables past ten words do not collide
- Input that is not in this format gets told the expected shape, rather than a bare parse error
How to use
- Paste the whole `eval(function(p,a,c,k,e,d){…})` into the box, leading `eval(` included
- Press Ctrl/⌘ + Enter or click Run
- The result is the recovered source
- Switch the direction to pack when you want to go the other way
FAQ
- Will this execute the script?
- No. Unpacking here is pure string manipulation: parse the parameters, then substitute short names back to their words. There is no `eval` anywhere in it. Many tools online take the shortcut of evaluating the code, which runs a stranger's script inside your browser — and packed code is exactly the code you should never run blindly. This implementation is safe to point at code of unknown origin.
- Can the output be run directly?
- Usually yes. What comes out is the original source with words substituted back and nothing else changed, so it can be pasted into a console or an HTML page. Two caveats: the original may itself have been minified (short variable names, no line breaks), and unpacking will not make that prettier — you want a formatter for that. And the recovered code is still third-party code you have not reviewed; making it readable is not the same as making it safe.
- Does packing reproduce the original output exactly?
- Not byte for byte. The original packer walks the source, counts word frequencies and assigns short names by its own rules. The implementation here is a simplified version (extract identifiers, rank by occurrence, hand out the shortest available indices). The format is compatible — browsers run it, and this tool unpacks it — but the assignment may differ. Use the original script if you need its exact output.
Related tools
JS Obfuscate
FormatStrip comments and whitespace, escape strings and numbers, rename local variables — smaller, and harder to skim. All local.
JS Minify & Beautify
FormatMinify JavaScript (comments and whitespace stripped, /*! licences kept) or beautify it by re-indenting on braces and semicolons. Nothing is uploaded.
Code Highlighter
WebColourise code and copy it with the colours intact into slides, Word or email — or export inline-styled HTML for a blog. 26 languages supported.
Base64
EncodingConvert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.
URL Encode
EncodingEscape text into %XX form and back again, treating a whole URL and a single parameter value as different jobs. Runs entirely in your browser.
HTML Entities
EncodingTurn < > & and quotes into HTML entities and decode them back in a single pass, so &lt; becomes <, not an angle bracket. Runs in your browser.