Encode / Decode
Input
⚠ Could not decode, input may not be valid for this encoding type.
↕
Output
Output will appear here...
PowerShell Encoded Command Decoder

Attackers frequently use powershell -EncodedCommand <base64> to obfuscate malicious scripts.
Paste the Base64 string from a -EncodedCommand or -enc argument here to decode it. The output uses UTF-16LE encoding as PowerShell does.

Paste Encoded Command (Base64 only)
⚠ Not a valid Base64 encoded PowerShell command.
↓
Decoded Script
Decoded script will appear here...
Try These Examples
About This Tool

The Base64 Encoder / Decoder is a standard utility for IT professionals working with data encoding. Base64 is commonly used to encode binary data for transmission over text-based protocols, embed images in HTML or CSS, encode credentials in HTTP Basic Authentication headers, and store binary data in JSON or XML.

The Hex encoder converts text to its hexadecimal byte representation, useful when working with network protocols, memory dumps or low-level debugging. URL encoding converts special characters into percent-encoded format safe for use in URLs and query strings.

The PowerShell Encoded Command decoder is a security tool specifically for IT administrators and incident responders. Attackers frequently use the powershell -EncodedCommand flag to obfuscate malicious scripts from plain-text inspection. This decoder uses UTF-16LE encoding, the same encoding PowerShell uses, to reveal the actual script content, making it useful alongside Windows Event ID 4104 (PowerShell Script Block Logging) during malware investigations.