PowerShell Deobfuscator Online
Deobfuscate malicious PowerShell quickly. CyberNexus Decoder decodes Base64 EncodedCommand payloads, resolves -f format strings, strips backtick obfuscation, evaluates character concatenation, and unwinds compressed DeflateStream/GzipStream loaders — all locally in your browser.
Open the powershell deobfuscator tool →How to use the powershell deobfuscator
- Paste the obfuscated PowerShell script or encoded command.
- Run "PowerShell Deep Deobfuscate" for multi-pass resolution.
- For -enc payloads, apply From Base64 then Change Character Encoding (UTF-16LE to UTF-8).
- Use "Extract Network IOCs" to pull C2 URLs, IPs, and file paths from the result.
Features
- Multi-pass engine resolves nested obfuscation automatically.
- Handles EncodedCommand, format strings, backticks, and reversed strings.
- Decompresses DeflateStream and GzipStream loaders.
- Extracts indicators of compromise from the decoded script.
Frequently asked questions
How do I decode a PowerShell -EncodedCommand?
Paste the Base64 string, apply From Base64, then Change Character Encoding from UTF-16LE to UTF-8 to reveal the original command.
Can it deobfuscate Invoke-Obfuscation output?
Yes. The deep deobfuscator resolves backtick scattering, format strings, and concatenation produced by common PowerShell obfuscators.