# PHP Deobfuscator

> Free tool from Pyxsoft Anti Malware: paste obfuscated PHP and read the code that would really run. The code is never executed.

Source: https://www.pyxsoft.com/tools/php-deobfuscator
Updated: 2026-11-14

---

Paste a PHP file found on a server, or open it from disk (up to 1 MB). The deobfuscator returns readable code, the number of layers it decoded, and the URLs, IP addresses and email addresses the code uses.

## What it unpacks

- eval onions: eval, assert, create_function and preg_replace /e, layer after layer.
- Encodings: base64, gzinflate, gzuncompress, str_rot13, strrev, hex and octal escapes, urldecode, XOR keys.
- Built names: function names assembled from character tables, $GLOBALS arrays, variable variables and chr() chains.
- goto mazes: code shuffled with goto, put back in the order it runs.
- Custom decoders: the obfuscator's own decoding functions, run on their arguments without running the file.
- Hidden payloads: data after __halt_compiler or exit, code read from the file itself, AES keys taken from the User-Agent.

## Finding the rest

One obfuscated file is rarely alone on a compromised server. [Pyxsoft Anti Malware](https://www.pyxsoft.com/anti-malware) scans every account, reads obfuscated code the same way, and cleans injected code while the site keeps running. 3 of 4 threats Pyxsoft Anti Malware caught in the last 30 days were unknown to VirusTotal.

Install it as root (7 days free, no credit card): `curl -s https://www.pyxsoft.com/install-anti-malware | bash`