PowerShell decoder
Paste a command line with -EncodedCommand (or -enc, -e), or a log line that contains one, to see the script it really runs.
Runs in your browser. Nothing is sent unless you choose Check reputation, and nothing is stored.
What it shows
Attackers hide PowerShell in layers: base64 for -EncodedCommand, then FromBase64String with gzip or deflate inside. Bluebench peels each layer, up to 8 deep, until it reaches the script that would actually run, and keeps every layer so you can follow the chain.
Common techniques are flagged in plain English: download-and-run cradles, Invoke-Expression, switching off AMSI or Defender, loading code into memory, persistence, hidden windows and execution policy bypasses. Hidden files such as executables are named, with a hex dump.
Every URL, domain, IP and hash in the script is listed, ready to check against threat intelligence.
Nothing is run
The script is only decoded, never run, and its links are never visited. Decompression is capped at 1 MB a layer, so a decompression bomb can't freeze the page. Decoding happens in your browser. What you paste isn't sent to our server or anyone else, so it's safe to use with tokens and emails from real incidents.