a['b'] → a.b, constant folding), and renames meaningless _0x1a2b3c-style identifiers to readable sequential names like fn1/v1/arg1.
Honest limits: the original variable/function names are gone forever once obfuscated — there's no way to recover what they used to be called, only to replace the meaningless hex names with readable placeholders. Control-flow flattening (giant
switch-based dispatch loops) and dead-code-injection branches from the "High" preset are not unwound — the code stays fully correct, just more indirect in those specific spots. If a string-array pattern isn't recognized, this still simplifies whatever it safely can and beautifies the rest. The sandbox runs the array/decoder machinery using your original source text (not a reformatted copy), so it still resolves strings correctly even with "self-defending" turned on (an option in this site's own JavaScript Obfuscator) — but if that machinery contains a genuinely runaway loop, or the input embeds a separate self-check elsewhere in the program's own logic (a function comparing its own source text against a regex, which some "debug protection" code does), this tool detects that safely instead of freezing the tab, and warns you that the output may not run identically to the original in that specific spot.
Also unpacks the classic Dean Edwards-style
eval(function(p,a,c,k,e,d){...}) packer, and decodes hex/unicode string escapes. Everything runs locally in your browser via acorn/estraverse/astring (parsing, AST traversal, and code generation) plus js-beautify for final formatting — nothing is uploaded anywhere. Only paste code you trust the source of, since resolving the string array involves executing parts of it.