Pull the thread.
Unravel anything.
A deobfuscation workbench for obfuscated Lua and Luau scripts. Detection, payload extraction and a real multi-pass cleanup engine, plus a sandboxed Lua runtime that executes the script and catches the source it builds at runtime. Everything runs locally in your browser; your scripts never leave your machine.
Deobfuscator
Sandbox runtime
Executes the script in the input box above on a real Lua VM running in this tab (worker-isolated, timeout-guarded, zero network). The environment is stubbed executor-style: game, workspace, getgenv, HttpGet (returns empty and logs the URL), hookfunction and friends. Hooks on load and loadstring capture every chunk the script builds, so wrapped and per-build-encrypted sources unravel when they run. Luau compound assignments are lowered automatically before execution.
Support matrix
The sandbox below executes Luraph-style wrappers and captures whatever passes through load/loadstring, which recovers the real source for that whole class of builds. VM bytecode that never surfaces as loadable source (deep devirtualization cases) still needs the desktop engine. This page always tells you exactly what it did; it never pretends a pass ran when it did not.
How it works
Fingerprints the header, magic bytes and VM shape to name the obfuscator and version.
Pulls embedded payloads out of long strings and decodes the wrapper's own encoding layer.
Normalizes string escapes, folds string.char and literal arithmetic, then reformats the whole script with real indentation.
Shows every pass that ran with counts, so you know what changed and what did not.
Runs the script in a local Lua VM with load/loadstring hooks, capturing the source it builds at runtime.