piapia123
en

JavaScript eval Packer: Unpack and Pack

Encoding

Everything runs locally in your browser — nothing is uploaded

Input
Drop a file here to load its contents
Output

Handles the Dean Edwards packer — the `eval(function(p,a,c,k,e,d){…})` construct. It replaces words that recur in the source (`function`, `document`, `length`…) with short names, stores the compressed body as one string, and appends the lookup table. ⚠️ It is not encryption: there is no key, the table sits right there in the code, and unpacking needs nothing beyond it. The format spread widely — plenty of sites use it as "light obfuscation" — and it happens to be one of the easiest to reverse.

Features

  • Unpack: turn `eval(function(p,a,c,k,e,d){…})` back into readable source
  • Pack: generate the same format, with an adjustable radix (2–62)
  • ⚠️ Pure string manipulation — no JavaScript is executed
  • Single quotes, escapes and line breaks inside the payload all parse correctly
  • Replacement runs from the largest index down, so tables past ten words do not collide
  • Input that is not in this format gets told the expected shape, rather than a bare parse error

How to use

  1. Paste the whole `eval(function(p,a,c,k,e,d){…})` into the box, leading `eval(` included
  2. Press Ctrl/⌘ + Enter or click Run
  3. The result is the recovered source
  4. Switch the direction to pack when you want to go the other way

FAQ

Will this execute the script?
No. Unpacking here is pure string manipulation: parse the parameters, then substitute short names back to their words. There is no `eval` anywhere in it. Many tools online take the shortcut of evaluating the code, which runs a stranger's script inside your browser — and packed code is exactly the code you should never run blindly. This implementation is safe to point at code of unknown origin.
Can the output be run directly?
Usually yes. What comes out is the original source with words substituted back and nothing else changed, so it can be pasted into a console or an HTML page. Two caveats: the original may itself have been minified (short variable names, no line breaks), and unpacking will not make that prettier — you want a formatter for that. And the recovered code is still third-party code you have not reviewed; making it readable is not the same as making it safe.
Does packing reproduce the original output exactly?
Not byte for byte. The original packer walks the source, counts word frequencies and assigns short names by its own rules. The implementation here is a simplified version (extract identifiers, rank by occurrence, hand out the shortest available indices). The format is compatible — browsers run it, and this tool unpacks it — but the assignment may differ. Use the original script if you need its exact output.

Related tools