One-time pass · 10 days of access
Turn protected PHP files back into readable source
Upload an encoded or obfuscated PHP file. Dezender validates it, sends it to a dedicated decoding pipeline, and returns formatted source you can read, search and maintain. You get the pass status, the job history and the files in one dashboard.
- Pass price
- €20one-time
- Access window
- 10 days
- Renewal
- None
Checkout is not yet enabled on this deployment. Create an account to be notified when the pass goes on sale.
Illustration only. Recovery depends on how the file was protected; some files cannot be recovered.
What it does
A complete recovery workflow, not a script you have to babysit
Dezender handles the parts that make decoding a protected file awkward in practice: validation, queueing, retries, private storage, expiry and billing.
Durable job pipeline
Every upload becomes a job that is stored in the database before processing starts. Jobs survive restarts, retry transient faults with backoff, and are reclaimed automatically if a worker dies.
Input validation before processing
File type is decided from the bytes, not the filename. Archives are inspected for path traversal, symlinks, encrypted entries and decompression bombs before anything is sent upstream.
Private results
Uploads and results live in private object storage under random keys. Downloads are ownership-checked on the server, and results expire automatically at the end of their retention window.
Server-enforced pass
The 240-hour window, the job allowance and the byte allowance are enforced in the database on every submission — not in the interface. Expiry is checked again at the moment a job starts.
Verified payments only
A pass is activated by a signature-verified payment event whose amount and currency match the order. Duplicate notifications cannot create duplicate access.
Full history and receipts
See each job's state, timestamps, error reason and downloadable result, plus billing history and email confirmations when a pass is activated.
Three steps
From protected file to readable source
The workflow is deliberately short. What takes the time is the decoding itself, and you can see exactly where a job is at any moment.
Upload a file
Drag in a single PHP source file or a ZIP archive of PHP files. Dezender validates the content immediately and tells you what it recognised.
Nothing is queued until the file passes validation.
We run the decoding pipeline
The file is queued durably and handed to the decoding provider. You can watch the job state, and you are told if it is retried or if it cannot be reversed.
The provider's job reference is stored, so a restart never re-submits a file.
Download the source
When a decode succeeds, the result is validated, stored privately, and offered to you as a formatted download alongside an in-page preview.
Results are deleted at the end of the retention window shown on the job.
Supported input
What you can upload
Accepted by content, then classified so you know what the pipeline recognised before you spend any allowance.
Accepted file types
.ctp .inc .module .php .php3 .php4 .php5 .php7 .php8 .phps .phtml .tpl .zip
- ZIP archives containing only the file types above.
- Maximum upload size and pass allowance are shown on the pricing page.
- Anything else is rejected before a job is created.
What gets recognised
- Plain PHP source — passed through and formatted.
- base64 and gzip wrappers — commonly reversible.
- ionCube, SourceGuardian, Zend Guard, PHP Shield — created by commercial encoders and frequently not reversible. Dezender labels these before processing so you are not left guessing.
Recovery is best-effort. Some files cannot be decoded, and Dezender reports that rather than returning something that merely looks like source.
Privacy and security
Your files stay yours
Uploads are treated as untrusted and confidential at the same time, which drives decisions across storage, validation and access control.
Private object storage
Random object keys, files never served from the web root, downloads ownership-checked on the server.
Never executed
Uploaded PHP is never run or evaluated. Previews are escaped text, never rendered as HTML.
Automatic deletion
Inputs and results are deleted on a retention schedule, and expired sessions and tokens are purged.
Third-party processing disclosed
Files are sent to PHPDecode to be decoded. That transfer is stated plainly here, in the privacy policy and at upload time.
Read the privacy policy, the acceptable use policy and the refund policy.
Questions
Frequently asked questions
Short answers to the questions that decide whether Dezender is the right tool for your file.
What is Dezender?
Dezender is a PHP source recovery platform. You upload an encoded or obfuscated PHP file, Dezender validates it, submits it to a decoding service, and returns readable, formatted source in a dashboard you can download from. It is a finished product with accounts, a paid pass, job history and support, not a library or a command-line tool.
How does PHP source recovery work?
Protection tools usually apply a reversible transformation: base64 or gzip wrapping, a custom character-shuffling routine, or a commercial encoder. Recovery means reversing that specific transformation and then formatting the result so a human can read it. Dezender does not guess: it inspects the file, classifies what kind of wrapper it is, and sends it to a decoding pipeline that handles that family. Reversing the wrapper is not the same as recovering an author's original formatting, comments or variable names, and Dezender never claims it is.
Which file formats are supported?
Single PHP-family source files (.php, .phtml, .php3 to .php8, .inc, .module, .tpl, .ctp) and .zip archives that contain only those files. The file type is determined from the file's contents, not from its extension or the browser-reported type, and anything else is rejected before it reaches processing.
How does the Developer Pass work?
The Developer Pass is a one-time payment of €20 that gives you a 240-hour (10-day) window of access, counted from the moment the payment is verified on our servers. Inside that window you can submit files up to the pass allowance, see every job's status, and download your results. The pass is activated by a verified payment event, never by a browser redirect.
Does the pass renew automatically?
No. There is no automatic renewal, no stored mandate and no recurring charge. When the 240 hours elapse the pass simply expires; nothing is billed and no subscription continues. To keep using Dezender you buy another pass manually.
What happens if processing fails?
The job is marked as failed and you see the reason on the job page. Transient faults, such as the decoding service being briefly unreachable, are retried automatically with a delay. A failure that cannot succeed on retry, such as an encoding family the pipeline cannot reverse, is reported instead of being retried forever. Processing allowance consumed by a job that ultimately failed is restored to your pass.
Pricing
One pass, one price, no subscription
There is a single plan. You pay once, and the pass ends on its own.
Developer Pass
One-time access for a 10-day window
€20/ 10 days
- 100 processing jobs included
- 1 GB total upload allowance
- Up to 32 MB per file
- 2 jobs processed at the same time
- Job history, downloadable results and email receipts
- No automatic renewal, no stored mandate
Checkout is not enabled on this deployment yet. Create an account and we will notify you when the pass goes on sale.
How billing behaves
- Access starts on verification. The 240-hour clock begins when a verified payment event reaches our servers.
- No automatic renewal. There is no stored mandate and no recurring charge; the pass simply expires.
- Repurchase manually. A new pass starts a fresh 240-hour window and does not extend the previous one.
- Allowance is enforced server-side. Jobs and bytes are counted in the database, so limits cannot be bypassed from the browser.
No payment provider is configured, so checkout is disabled. Set PAYMENT_PROVIDER once a gateway has been verified (see docs/payment-integration.md).
Start decoding in a couple of minutes
Create an account, buy the Developer Pass, and upload your first file. You will see the recognised encoding family before the job is queued.