PowerShell EncodedCommand decoder
Paste a whole command line — powershell -nop -w hidden -enc JABz… — or just the Base64.
The decoder unwraps every layer, including nested FromBase64String calls and Gzip or Deflate
streams, and points out what deserves attention. Nothing is executed, and nothing leaves your browser.
How -EncodedCommand works
powershell.exe -EncodedCommand runs a command given as Base64 instead of plain text. PowerShell expects the
Base64 of the command’s UTF-16LE bytes, which is why decoded payloads start with characters such as JAB
($) or SQBFAFgA (IEX), and why decoding with an ordinary Base64 tool shows a null byte after
every letter. PowerShell also accepts abbreviations of the parameter, so the same thing appears as -enc,
-ec or -e in the wild; the decoder recognises all of them.
Administrators use the switch to pass scripts with awkward quoting through other tools. Attackers use it because a Base64 blob hides
intent from a quick look at a process list, an alert or a scheduled task — and they often nest a second encoding inside the
first: a [Convert]::FromBase64String(…) call that is unpacked at run time, frequently wrapped in
IO.Compression.GzipStream or DeflateStream to shrink it. Each of those layers is shown separately here,
in the order PowerShell would unpack them.
Where you find encoded commands
- Process creation events — Windows event 4688 with command-line auditing enabled, Sysmon event 1 (Sysmon field reference) and EDR process telemetry — record the encoded command line.
- PowerShell Script Block Logging (event 4104) records the script blocks PowerShell compiles, which shows the command after decoding — compare it with what you decode here.
- Persistence — scheduled tasks, services and Run keys whose command line calls PowerShell with an encoded argument.
What the decoder flags
Each finding links to its MITRE ATT&CK technique. A flag is a reason to look closer, not a verdict: administrators download and run scripts too.
- Downloads content from the network — T1105
- Executes a string as code (Invoke-Expression) — T1059.001
- Runs hidden or without a profile — T1564.003
- Bypasses the execution policy — T1059.001
- Changes Microsoft Defender settings — T1562.001
- Tampers with AMSI (anti-malware scanning) — T1562.001
- Loads code into memory (reflection / native API) — T1620
- Creates persistence (scheduled task, Run key, service) — T1053.005
- Touches credentials — T1003
- Further obfuscation layers — T1027
URLs and IP addresses found in any layer are listed so you can check them against your proxy, DNS and firewall logs.
Questions
- Is it safe to paste a malicious command here?
- Yes. The page only decodes text: nothing is executed, and the input never leaves your browser. Decoded output is shown as plain text, so markup or script inside a payload cannot run on the page.
- Where do I find the decoded script in Windows logs?
- With PowerShell Script Block Logging enabled, event 4104 in the Microsoft-Windows-PowerShell/Operational log records the script blocks PowerShell compiles, which shows the decoded command. Process creation telemetry — event 4688 with command-line auditing, Sysmon event 1, or your EDR — shows the encoded command line itself.
- What do -nop and -w hidden mean?
- -nop (-NoProfile) skips loading the user’s PowerShell profile and -w hidden (-WindowStyle Hidden) hides the console window. Together with -enc they are typical of commands started by malware, macros or remote tooling rather than by a person at a keyboard.
- The output has odd characters. Is the decode wrong?
- PowerShell encodes -EncodedCommand as UTF-16LE. If the payload was produced with a different encoding, or is a binary blob rather than script, the text will look garbled; the decoder picks UTF-16LE or UTF-8 automatically from the byte pattern, and shows which one it used.
Found it in a process log? Look at the whole host
Upload a Sysmon, Windows Security or EDR export to LogTriage: suspicious command lines, credential dumping and lateral movement are scored together, enriched with threat intelligence and written up as an incident report.