Is this code safe?
Paste code before you run it. We'll explain what it does and flag suspicious behavior.
Paste code on the left and press Check Code.
The scanner reports:
- network requests and the hosts they contact
- file reads, writes and deletions
- shell command execution
- code built and executed at runtime
- access to cookies, credentials, clipboard and keystrokes
- persistence, privilege changes and security tool tampering
- encoded payloads and obfuscation
Findings are separated into capabilities (what the code can do) and suspicious behaviour (patterns typical of malicious scripts), because using the network is not the same as stealing data.
Static checks run locally in your browser. Nothing is uploaded, logged or stored.
Press Ctrl/Cmd + Enter to check.
How it works
Before you paste code from a forum, an AI answer or a random gist into your terminal or browser console, check what it actually does. The checker runs a deterministic rule engine over the code and reports every capability it finds, then flags the combinations that dangerous scripts rely on.
- The language is detected from the code, and you can override it in the dropdown.
- JavaScript and TypeScript are parsed into an abstract syntax tree, so function calls, imports and property accesses are matched structurally rather than as text. Python, PowerShell and shell are scanned with rules that first mask comments and string contents. HTML is scanned tag by tag, with inline scripts handed to the JavaScript analyzer.
- Findings are split into capabilities (what the code can do) and suspicious behaviour (patterns typical of malicious code).
- Behaviour chains are evaluated: reading cookies is one thing, reading cookies and posting them to a hardcoded host is another.
- A risk level is assigned, every finding links to its line, and you can optionally ask an AI model to explain the result in prose.
What it detects
- network requests, with the exact hosts and endpoints contacted
- file reads, writes and deletions, including credential and wallet paths
- shell and process execution, including commands assembled from strings
- code built and executed at runtime: eval, new Function, Invoke-Expression, exec
- cookies, browser storage, environment variables, clipboard and keystroke capture
- persistence: registry run keys, cron jobs, scheduled tasks, systemd units, shell profiles
- security evasion: antivirus and firewall changes, log and history clearing
- obfuscation: Base64 and hex payloads, escape-sequence strings, packed one-liners
Privacy: your code stays in your browser
The whole static analysis, including parsing, rule matching and risk scoring, is compiled into the page and runs on your machine. No request is made when you press Check Code, nothing is logged and nothing is stored. The only exception is the optional AI explanation: it is off by default, and when you tick the box the code is sent to the configured AI provider for that single request.
Why we never say "this code is safe"
Nobody can prove a piece of code is harmless by inspecting it. Code can fetch its real payload at runtime, behave differently on another machine, or hide its intent in a dependency you cannot see. So the verdict is always one of four: low apparent risk, potential risk, high risk, or unable to determine. "Low apparent risk" means these particular patterns are absent — nothing more.
Frequently asked questions
- What does this tool actually check?
- It looks for network requests, file reads and writes, shell command execution, code built and executed at runtime, access to cookies, credentials, clipboard and keystrokes, persistence and privilege changes, security tool tampering, and encoded or obfuscated payloads. It also evaluates combinations, such as reading local secrets and uploading them.
- Is my code uploaded anywhere?
- No. The static analysis is compiled into the page and runs in your browser, so pressing Check Code makes no network request at all. The optional AI explanation is the only feature that sends code anywhere, it is off by default, and you are told before it happens.
- Which languages are supported?
- JavaScript, TypeScript, Python, PowerShell, Bash/shell and HTML. JavaScript and TypeScript use a real AST parser; the others use rules that mask comments and strings before matching so documentation text cannot trigger findings.
- Can it tell me a script is definitely safe?
- No, and it never claims to. Static analysis can only show that known dangerous patterns are absent. A script can still fetch its real payload at runtime or depend on code you cannot see, which is why the best verdict available is "low apparent risk".
- Why does it flag code that I know is fine?
- Capabilities are reported separately from suspicious behaviour precisely for this reason. Seeing "network access: yes" for a script that calls an API is correct and expected; it does not raise the risk level on its own.
- Do I need an account?
- No. There is no sign-up, no project to create and nothing to install. Paste, check, leave.