About the Base64 to Javascript Converter
Encoded scripts show up in obfuscated bundles, in bookmarklets, in analytics tags and in data:text/javascript URIs found while auditing a page. Reading them is the first step of working out what they do, and that is what the default mode gives you: the original source, with JavaScript syntax highlighting and a count of the function definitions it contains.
The string literal mode wraps the decoded text in a properly escaped JavaScript literal, quotes, backslashes, newlines and all. That saves the fiddly manual escaping when you need to embed a script as data inside another script, or drop a fixture into a test file.
The loader mode goes the other way. Instead of decoding for you, it emits a short snippet that carries the Base64 as a wrapped string constant and decodes it at runtime with atob and a TextDecoder. The variable name is yours to choose. This is the pattern used when a payload needs to survive a build step or a template engine that would otherwise mangle its punctuation, and the wrapped concatenation keeps every line under a sensible width.
Decoded code from an unknown source should be read, never pasted into a console: atob only decodes, but running the result executes whatever it contains. To go the other way use JavaScript to Base64, and JavaScript Beautifier will reformat a minified result.
How to use
- Paste the Base64 into the left pane, with or without a data URI prefix.
- Keep Result on decoded source to read the script.
- Switch to the loader mode and set a Variable name to generate a runtime decoder instead.
- Copy the output or download it as a
.jsfile.
Common questions
- Is it safe to decode a script I do not trust?
- Decoding is safe because nothing is executed. Reading the result is fine, running it is not.
- The decoded code is one long line. Can I format it?
- Yes, paste it into JavaScript Beautifier, which restores indentation and line breaks.
- Why does the loader use atob rather than Buffer?
- The snippet is written for the browser. In Node you would use Buffer.from with the base64 encoding instead.
- What if the payload is not text at all?
- You will get an error saying the bytes are binary. Use the loader mode, which works with any payload, or save it as a file.