Malware snippet decoder
Attackers wrap loaders in base64, gzinflate, rot13, hex escapes and fromCharCode so that a glance at the file shows nothing readable. Paste the snippet here: the decoder unwraps each layer as text, flags the patterns that matter — a startup directive, a conditional redirect, PHP executing from an image extension, eval on request data — and lists the domains, IP addresses and paths it found. Nothing is executed and nothing leaves your browser.
Never send credentials, private keys, backup archives, or confidential source code through this website.
What it looks for
auto_prepend_file and auto_append_file in .user.ini, php.ini or a php_value line make PHP run a file before or after every request. The decoder shows the target path and flags uploads, cache, temp and hidden files — and recognises Wordfence’s own wordfence-waf.php.
RewriteCond lines that test the referrer for a search engine or the user agent for a phone, followed by a RewriteRule to another domain, are how redirect malware hides from the site owner.
AddHandler, AddType or SetHandler lines that map .ico, .png, .jpg or .txt to the PHP handler let an attacker store a loader under an innocent extension.
eval, assert, system and their relatives fed from $_POST, $_GET, $_REQUEST or a cookie are a remote shell, however the call is spelled.
base64_decode, gzinflate, str_rot13, strrev, hex2bin, hex and octal escapes, chr() chains, atob and String.fromCharCode are unwrapped, and the result is analysed again — up to six layers deep.
Every domain, URL, IP address and file path found in any layer is listed, so you can search your logs, database and other sites for the same infrastructure.
After decoding
A loader is the part of an infection you can see. Something wrote it, and something is likely to write it again: a second directive in a parent directory, an autoloaded database option, a must-use plugin, a scheduled task, a stolen password, or a neighbouring site in the same account. Deleting the decoded file without finding those is the most common reason the same infection is back within days.
Preserve the file and its timestamps first, remove the directive or include that loads it before the file itself, then look for the rest of the persistence. The guides below take each layer in turn.
Common questions
Yes. The decoder treats everything as text: it never evaluates code, never loads a URL it finds, and displays every result as plain text rather than HTML. Nothing you paste is sent to a server.
You can, but remove the database password, the authentication keys and salts, and any API keys first. The decoder does not need them, and it is a good habit with any tool.
It means none of the patterns the decoder knows were present in what you pasted. Obfuscation varies endlessly, and a clean configuration line can still point at a malicious file. Read the file a directive names, and compare core files against official checksums.
Some loaders build their payload at runtime from values only the server has, or fetch it from a remote address. Those cannot be decoded from the text alone; the decoder lists the address so you can search your logs for it instead of visiting it.