PowerShell String Obfuscator
Obfuscate PowerShell string literals using 5 different techniques: Base64 + [System.Text.Encoding]::UTF8.GetString, [char] array + -join, XOR-encrypted byte arrays with -bxor decryption, format operator (-f) split concatenation, and backtick escape sequences. Each method generates valid PowerShell code that produces the original string at runtime. Compare all methods side by side, filter by technique, and copy the generated code - all free, private, and no signup required.
Obfuscate PowerShell string literals using 5 different techniques: Base64 + [System.Text.Encoding]::UTF8.GetString, [char] array + -join, XOR-encrypted byte arrays, format operator (-f) split concatenation, and backtick escape sequences. Each method generates valid PowerShell code that produces the original string at runtime. Compare all methods side by side or focus on one.
Enter a PowerShell string above to obfuscate it using 5 different techniques. Choose from Base64 + Encoding.GetString, [char] array + -join, XOR encryption, format operator (-f) split, or backtick escape sequences. Click any example below the input to get started.
Features
5 Obfuscation Methods
Choose from Base64 + Encoding.GetString, [char] Array + -join, XOR Encryption, Format Operator (-f) Split, and Backtick Escape Sequences. Each generates valid PowerShell code that produces the original string at runtime.
Side-by-Side Comparison
View all 5 methods simultaneously to compare code size, readability, and obfuscation strength. Filter to focus on a single method when you find one that fits your needs.
Size Impact Analysis
Each method shows character count and size increase from the original string, helping you balance obfuscation strength against code size. Average stats across all methods included.
Example Presets
Quickly test with realistic PowerShell strings: API keys, connection strings, script paths, and common phrases. Instantly see how each method transforms different types of content.
Use Cases
Red Team & Penetration Testing
Obfuscate PowerShell payloads, command strings, and IP addresses to evade signature-based detection by antivirus and EDR solutions during authorized security assessments.
API Key & Credential Hiding
Protect hardcoded API keys, authentication tokens, and service credentials in PowerShell scripts from casual inspection and automated secret scanners.
Script Delivery & Execution
Encode PowerShell one-liners and download cradle strings to bypass network-based detection of known malicious patterns and plaintext indicators.
Memory-Only Execution
Hide strings used in Invoke-Expression, IEX download cradles, and reflective loading techniques where the original command should not appear in process listings.
Log & Audit Evasion
Obfuscate sensitive strings in PowerShell scripts to prevent plaintext exposure in ScriptBlock logging, Transcript logs, and Windows Event Logs.
Code Protection for Modules
Protect proprietary logic in PowerShell modules and DSC resources by obfuscating internal strings, configuration data, and hardcoded values from easy extraction.
About PowerShell String Obfuscation
What Is PowerShell String Obfuscation?
PowerShell string obfuscation transforms readable string literals into equivalent representations that are hard for humans and automated detection tools to understand. Instead of writing 'Hello', you might use [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('SGVsbG8='))or ([char[]](72,101,108,108,111) -join ''). Both produce the same string at runtime but are much harder to detect through static analysis.
How the Obfuscation Works
The PowerShell String Obfuscator applies five distinct transformation techniques.Base64 encoding wraps the string in Convert.FromBase64String().[char] arrays represent each character as an integer code point.XOR encryption XORs each byte with a random key.Format operator split fragments the string across multiple arguments.Backtick escapes convert special chars to `xNN sequences. Each technique uses randomization for different output on every generation.
Relevance in Security Testing
PowerShell is a primary tool for both Windows administration and adversarial operations. String obfuscation is routinely used in penetration testing and red team engagements to bypass AMSI (Anti-Malware Scan Interface), evade signature-based detection, and avoid plaintext exposure in script logs. Understanding these techniques helps both attackers and defenders recognize common obfuscation patterns.
Privacy & Security
This tool runs entirely in your browser using client-side JavaScript. Your input strings and the generated obfuscated outputs never leave your device. There are no API calls, no server-side processing, no data storage, and no tracking. The obfuscation engine uses JavaScript's built-in string and number methods for all transformations - everything is local and private.
Related Obfuscator Tools
JavaScript Number Obfuscator
Obfuscate numeric literals in JavaScript code by converting them to math expressions, hex, octal, binary, and bitwise tricks.
JavaScript All-In-One Obfuscator
Combine multiple JS obfuscation techniques - variable renaming, string encoding, dead code, numbers, and control flow.
JavaScript Variable Name Deobfuscator
Analyze obfuscated JavaScript variable, function, and class names and suggest meaningful names based on usage context.
Java Control Flow Flattener
Flatten Java control flow into a switch-based dispatcher for obfuscation. Configurable depth with size analysis.
JavaScript Domain Lock Obfuscator
Add domain-locking to your JavaScript code with runtime hostname checks, encrypted allowed domain lists, and custom blocking.
CSS Variable Name Obfuscator
Rename CSS custom properties (--variable) and update all var() references across CSS, HTML, and JS. Shows full rename mapping.
Pixel Shuffle Image Obfuscator
Scramble and descramble images using seed-based pixel permutation. Fisher-Yates shuffle with Mulberry32 PRNG, lossless PNG output.
Image Noise Layer Obfuscator
Add controlled Gaussian, Uniform, or Salt & Pepper noise to obscure image details. Seed-based deterministic reversal, adjustable intensity.
Rust Integer/Literal Obfuscator
Obfuscate Rust numeric literals using hex, octal, binary, math expressions, bitwise tricks, and arithmetic combos. Supports i32, u64, f32, usize.
.NET String Encryptor/Obfuscator
Obfuscate C# string literals using hex escapes, Convert.FromBase64String, XOR encryption, char arrays, StringBuilder, and Unicode escapes.
.NET Integer/Number Obfuscator
Obfuscate .NET numeric literals using hex, binary, bitwise, arithmetic, Convert.ToInt32/64, type suffixes, and unchecked expressions. Supports int, long, float, decimal.
Swift String Obfuscator
Obfuscate Swift string literals using hex byte arrays, Data + Base64 encoding, XOR Data, Unicode scalars, and split concatenation. Copy generated code.
Bash Variable Name Obfuscator
Replace Bash variable names with short obfuscated names. Preserves builtins, special variables ($?, $@, $#), and environment variables (PATH, HOME). Complete mapping table.
Dart String Obfuscator
Obfuscate Dart string literals using hex escapes, String.fromCharCodes, Base64 decode, XOR encryption, split concatenation, and StringBuffer + writeCharCode calls.
Frequently Asked Questions
PowerShell string obfuscation transforms readable string literals in PowerShell scripts into equivalent but hard-to-read representations. For example, "Hello" might become [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("SGVsbG8=")) or ([char[]](72,101,108,108,111) -join ''). Both produce the same string at runtime but are much harder to detect through static analysis.
The tool supports 5 methods: Base64 + [System.Text.Encoding]::UTF8.GetString, [char] array + -join, XOR-encrypted byte arrays with runtime decryption using -bxor, format operator (-f) split concatenation, and backtick escape sequences (`xNN). Each method generates valid PowerShell code that works in PowerShell 5.1 and PowerShell 7+.
XOR encryption and [char] arrays offer the strongest obfuscation because the original string is not directly recoverable without executing the transformation. Base64 encoding is well-known and easily recognized by experienced analysts. The format operator split adds the benefit of fragmenting the string across multiple arguments, making pattern matching harder.
String obfuscation can help bypass AMSI (Anti-Malware Scan Interface) by removing plain-text signatures from your PowerShell code. However, AMSI also scans at runtime when the string is deobfuscated. Combining string obfuscation with other evasion techniques like memory-only execution, reflection, and API unhooking provides stronger protection.
Yes. All generated code is compatible with PowerShell 5.1 (Windows) and PowerShell 7+ (cross-platform). The [System.Convert] and [System.Text.Encoding] classes have been available since PowerShell 1.0. The -bxor operator and -join operator work in all modern versions. Backtick escapes are a fundamental PowerShell feature.
Absolutely. The PowerShell string obfuscator runs entirely in your browser. Your input strings and obfuscated output are never sent to any server. All processing happens locally on your device. No signup required.
The XOR method converts each character to its ASCII byte value, then XORs each byte with a randomly chosen single-byte key. The output includes both the XORed byte array values and the key as integer literals. At runtime, PowerShell uses the -bxor operator to XOR each byte back, then converts each byte to a character using [char], and joins them with the -join operator.
Yes. String obfuscation complements PowerShell obfuscation frameworks like Invoke-Obfuscation, Out-EncodedCommand, and ISE Steroids. Apply string obfuscation to individual sensitive strings, then wrap the full script with additional encoding layers for multi-layer protection.
Yes - 100% free with no signup, no account, and no usage limits. All 5 obfuscation methods, side-by-side comparison, and copy functionality are available without any restrictions.