RecipeCONSTRUCTEDUntested
JavaScript String.fromCharCode, back to readable text
One operation for a common trick in malicious JavaScript and HTML attachments: a string written as a list of decimal character codes so that no readable word appears in the file.
1 operationschecked 2026-09-26
You are looking at this when
String.fromCharCode followed by a long run of comma-separated numbers, mostly between 32 and 126, in a script or an HTML attachment. Copy the numbers between the brackets, without the brackets.
How it was checked
The sample was built and checked in Python. The base argument is 10 because fromCharCode takes decimal codes and CyberChef's default for this operation is 16. The recipe has not been loaded into CyberChef by whoever wrote this page.
- 1From Charcode
[
{
"op": "From Charcode",
"args": [
"Comma",
10
]
}
]Sample input (constructed)
97,108,101,114,116,40,34,99,111,110,115,116,114,117,99,116,101,100,32,115,97,109,112,108,101,32,102,114,111,109,32,116,104,101,32,114,101,99,105,112,101,32,98,111,111,107,34,41
Expected output
alert("constructed sample from the recipe book")The one argument that matters
From Charcode defaults to base 16, because it is often used for hex. The
numbers in a String.fromCharCode call are decimal. Leave the default and every
character comes out wrong in a way that still looks like text, which is worse
than an obvious failure. The recipe sets it to 10.
Where you will see it
In HTML attachments that build a download in the browser rather than carrying a link a mail gateway could check, and in scripts that want no readable URL or keyword on disk. The decoded output is usually a URL, a second script, or the start of a base64 blob, in which case the gzip and base64 recipe is often the next step.
Evidence hygiene
This is evidence from a message somebody received. Open CyberChef from a downloaded copy rather than the hosted page so the question of where it went never arises.