Unpack. Unminify. Understand.
The JavaScript
decompiler.
Wakaru unpacks webpack, esbuild, and other production bundles, then reverses minifier and transpiler output into readable modern JavaScript.
Real, unedited output. Wakaru recovers structure deterministically.
// what it handles
Three layers of transformation, reversed
bundlers
webpack 4/5 (including Vercel ncc CommonJS output with an IIFE webpack bootstrap), esbuild, Bun, Metro, Browserify (including Cocos Creator 2.x), Closure ModuleManager, SystemJS, AMD/UMD, and scope-hoisted ESM output (Rollup, Vite).
transpilers
Babel, TypeScript/tslib, and SWC helper recovery: async/await from generator state machines, classes, spread/rest, enums, JSX, optional chaining, nullish coalescing, default parameters, and more.
minifiers
Terser, SWC, and esbuild artifact reversal: sequence expressions, flipped
comparisons, !0/void 0 literal tricks, IIFE flattening,
alias inlining.
// receipts
Tested like a compiler
Wakaru restores structure while respecting JavaScript semantics.
// rewrite levels
Choose how far it rewrites
One dial, three positions — from behavioral fidelity to maximum readability. Every level has a documented semantic contract, evaluated by the canonical Test262 round-trip harness.
minimalHighest-confidence, semantics-preserving transforms. For auditing, diffing, and malware triage, where behavioral fidelity matters most.
$ wakaru --level minimal
standarddefaultThe balanced default: full helper and syntax recovery under the documented assumptions. What you get when you pass no flag at all.
$ wakaru input.js
aggressiveYou just want to read the code. Enables stronger intent-recovery heuristics that produce cleaner output but may alter edge-case behavior.
$ wakaru --level aggressive
// for coding agents
Give your agent eyes
Coding agents hit unreadable minified JS constantly. Wakaru ships a
SKILL.md —
drop it into Claude Code, Codex, Grok, or any agent that reads skills, and your agent
can unpack the bundle it just choked on, read the recovered modules like ordinary
source, and pick the rewrite level that fits the task.
# agent hits dist/main.js — one line, unreadable
$ npx @wakaru/cli dist/main.js --unpack -o out/
# readable modules the agent can actually work with
$ ls out/// use cases
What people use it for
Security review & bug bounty
Read what a site actually ships instead of scrolling one 5 MB line. Split the bundle, find the first-party code, audit it as modules.
Incident response & malware triage
Unminify a suspicious script into something a human can diff and reason about,
using minimal level to favor behavioral fidelity.
Recover lost source code
The vendor vanished, the laptop died, and all that's left is dist/.
Reconstruct a workable codebase from the bundle — wakaru extract recovers
originals when the source map includes sourcesContent.
Debug a third-party SDK
Turn the vendored blob into readable modules so the stack trace points at code you can actually understand.
Supply-chain inspection
See what's inside a dependency's shipped bundle rather than trusting the repo it claims to be built from.
Something we missed?
Tell us how you use Wakaru — or what's stopping you. Share real-world bundles, bugs, and feature requests on GitHub or in the Telegram group.
// faq
Questions
How is Wakaru different from a formatter or beautifier?
A formatter only changes whitespace and layout. Wakaru rewrites the JavaScript AST to reverse minifier artifacts, restore transpiled syntax, remove bundler runtime patterns, and split bundles back into modules.
How do I unminify JavaScript?
Run npx @wakaru/cli input.js -o output.js, or paste the code into the
playground. Wakaru reverses minifier artifacts (sequence
expressions, !0/void 0 literal tricks, flipped comparisons) and
transpiler helpers (Babel, TypeScript, SWC) to recover readable modern JavaScript.
How do I decompile a webpack bundle and extract its modules?
Run npx @wakaru/cli bundle.js --unpack -o out/. Wakaru detects webpack 4/5,
esbuild, Bun, Metro, Browserify and Cocos Creator 2.x, Closure ModuleManager, SystemJS,
AMD/UMD, and scope-hoisted Rollup/Vite output, then splits the bundle into individual
modules and decompiles each one.
Can Wakaru deobfuscate JavaScript?
No — heavy obfuscation such as string arrays, control-flow flattening, and VM-based protectors is a different problem. Strip it first with a dedicated tool like webcrack, then use Wakaru to recover readable modules:
# 1. strip the obfuscation
$ npx webcrack --no-unpack --no-unminify obfuscated.js > deobfuscated.js
# 2. recover readable modules
$ npx @wakaru/cli deobfuscated.js --unpack -o out/Can it recover original variable names?
When the source map includes original names, yes — Wakaru recovers them and deduplicates imports. Without one, it applies conservative renaming heuristics where the code gives evidence, but most mangled names stay short. Pair it with an LLM renamer like humanify if you want guessed names.
Is the output guaranteed to behave the same?
Wakaru is designed to preserve behavior while recovering readable structure. Its
three rewrite levels
let you choose between behavioral fidelity and stronger readability-oriented recovery;
use minimal when fidelity matters most. Semantic preservation is continuously
measured with the Test262 round-trip harness.
Does it run in the browser?
Yes — the playground is the WebAssembly build of the same Rust engine, running entirely in your browser. No code leaves your machine.
The bundle isn't a wall.
It's a door.
Drop a minified file in the playground, or point the CLI at your bundle.
$ npx @wakaru/cli bundle.js --unpack -o out/