PowerShell Obfuscator / Deobfuscator / Formatter

Security Client-side powershell obfuscator deobfuscator one-liner formatter base64 encodedcommand minify beautify

This tool runs entirely client-side, in your browser: your data is never sent anywhere.

What it does

A multi-mode toolkit for working with PowerShell scripts:

Obfuscate — wraps your script as a Base64 -EncodedCommand one-liner (UTF-16LE, exactly like PowerShell itself expects), with optional string-splitting / backtick-insertion / case-randomization obfuscation on top of the source before encoding.
Deobfuscate — reverses common obfuscation tricks: decodes -EncodedCommand/-enc Base64 blobs (including nested layers), strips backtick (` `) escape characters used to break up detection signatures, collapses +-concatenated strings, and resolves simple [char]` / string-format obfuscation.
One-liner — flattens a multi-line script into a single line (semicolon-joined, comments and blank lines stripped), useful for payloads that must be pasted into a single command box.
Formatter (beautify) — re-indents a minified/one-lined script into readable multi-line PowerShell, with consistent brace placement and indentation.

Everything runs entirely in your browser — nothing is uploaded anywhere, so this is safe to use on sensitive or malicious-looking scripts.

Try it

Mode

Obfuscation extras (applied before encoding)

Input

Output

How it works

Obfuscate mode

Optionally mangles the source: splits identifiers with random backticks (` ``, ignored by the PowerShell parser almost everywhere) and/or randomizes the case of letters (PowerShell is case-insensitive for cmdlets, variables, and keywords).
Encodes the resulting text as UTF-16LE, then Base64 — the exact encoding powershell.exe -EncodedCommand expects.
Wraps it into a ready-to-run command: powershell -NoProfile -EncodedCommand <base64>.

Deobfuscate mode

If the input contains -EncodedCommand/-enc/-e followed by a Base64 blob (or is itself a bare Base64 blob), decodes it as UTF-16LE text. This is repeated up to a few layers deep in case of nested encoding.
Removes backtick escape characters (` `) that don't form a real PowerShell escape sequence ( n `, t `, r `, 0 `, , ' `, " ``), since these are almost always inserted purely to break signature-based detection.
Collapses simple adjacent string concatenations, e.g. "Wr" + "ite-Host" → "Write-Host".
Resolves basic [char]65 / [char]0x41-style character-code obfuscation back into literal characters where unambiguous.
Runs the result through the same formatter used in Formatter mode, so the final output is indented and readable.

One-liner mode

Strips full-line and trailing # comments, strips blank lines, trims each line, and joins everything with ; (skipping semicolons after tokens that don't need them, like after {, (, |, or before }) so the result is a single valid PowerShell command line.

Formatter mode

A lightweight brace/paren-aware re-indenter: it walks the script character by character (respecting strings and comments so braces inside them are ignored), increases indentation after {/(/[, decreases before }/)/], and splits statements on top-level ; so each ends up on its own line.

Limitations

This is a static, best-effort tool — it does not execute any code. It handles the most common obfuscation patterns seen in malware samples and CTF challenges (Base64 EncodedCommand, backtick-splitting, string concatenation, [char] codes), but heavily obfuscated or multi-stage droppers (e.g. compressed streams, .NET reflection, custom XOR routines) may need manual work beyond what this tool automates.