Developers hide keys in source by encoding them, usually reasoning that a casual reader will not recognise the value. This tool demonstrates how little that accomplishes: it strips the layers automatically and shows each one it removed.
Layers it recognises
Applied repeatedly until nothing more can be removed:
- Base64 and Base64URL — decoded when the result reads as text.
- Hexadecimal — packed hex that decodes to printable characters.
- Percent-encoding —
%41%42%43. \xescapes —\x41\x42, common in obfuscated JavaScript.\uescapes —AB, common in JSON.- Character-code arrays —
[104,101,108,108,111]orString.fromCharCode(...). - ROT13 — applied when the result contains credential-shaped words.
- Reversal — applied on the same basis.
The tool only accepts a decoding when the result is more meaningful than the input, which stops it turning a genuine random key into noise.
Obfuscation is not protection
If your application can decode a value at runtime, so can anyone with your bundle. The decode logic ships alongside the encoded value — it has to, or the application would not work.
Client-side "protected" secrets are extracted routinely and automatically. Tools that scrape npm packages and JavaScript bundles for credentials handle every one of these transformations.
The only correct handling for a secret that a client must not have is: the client does not have it. Proxy the call through your backend, where the credential lives in an environment variable.
Where it is legitimately useful
Incident response. Someone found an encoded value in a bundle and needs to know whether it is a real credential.
Code review. A dependency contains an encoded string and you want to know what it is before shipping it.
Malware analysis. Layered encoding is standard practice for hiding command-and-control endpoints and embedded payloads.
Auditing your own code. Finding out that a previous developer's "hidden" key was one Base64 decode away from being public.
If it finds a real credential
The status will say so. Treat it as compromised — it has been in a bundle, a repository or a file, and encoding never protected it. Rotate it using the revocation generator, then move the value server-side.
Frequently asked questions
Is my input sent anywhere?
No. The decoding runs in your browser. Load the page, disconnect, and it still works — which matters when analysing something from a private codebase.
It found nothing. Is my value safe?
It may be encrypted rather than encoded, in which case a key is needed and no automatic decoder can help. Or it may already be plaintext. Or it may use an encoding scheme not covered here. Nothing found is not a guarantee.
Should I obfuscate keys in my mobile app?
It slows down a casual attacker by minutes and does not stop anyone determined. Mobile apps should authenticate to your backend, which holds the third-party credentials. Where a key genuinely must be embedded, restrict it by bundle identifier and treat it as public.
How do I find obfuscated secrets across a codebase?
Grep for the markers — fromCharCode, atob, \\x, Buffer.from(..., 'base64') — then decode what you find here. The secret leak scanner catches plaintext credentials; obfuscated ones need this step first.