Can it recover the original variable names?
No, and neither can anything else. When a minifier renames a variable to a, the original name is deleted from the file. There is nothing left to recover. Tools that appear to restore names are inferring them from context, usually with a language model, and the result is a plausible guess rather than the truth. If the file shipped with a source map, that is the only real answer.
Will it unwrap eval or atob?
No, deliberately. Unwrapping those means either executing the code or symbolically evaluating it, and executing an unknown obfuscated script is precisely the thing you must not do while investigating it. This tool is a text transform: it decodes escapes, evaluates plain String.fromCharCode calls, and re-indents.
What does it do about the _0x names and the string array?
Nothing. The obfuscator.io pattern hides every string in a shuffled array and replaces each use with an index lookup, often through a rotation function. Reversing it means evaluating that rotation, which this tool does not do. You will get readable, well-indented code that still refers to _0x1a2b[0x3] everywhere.
Is obfuscated JavaScript a security measure?
No. Anything shipped to a browser can be read by whoever receives it, and obfuscation only raises the time cost. It is a deterrent and a licence-enforcement nuisance, not protection. Never put a secret, a key, or a security check that matters into client-side JavaScript, obfuscated or not.
Is it safe to paste malicious code in here?
Yes, in the sense that the code is never executed. It is tokenised and rewritten as text, in your browser, and never sent to a server. That is exactly why a deobfuscator should not evaluate anything: the moment a tool evaluates a hostile script to unwrap it, the tool has run the malware.
What is the difference between minified and obfuscated?
Minification shortens code to make it smaller: names get shorter, whitespace goes, and the transform is semantically neutral. Obfuscation actively works to make code hard to read: string arrays, control-flow flattening, dead code, and encoded literals. Pretty-printing fully reverses the readability cost of minification; it barely dents obfuscation.