API-based PHP deobfuscator — download, configure, and run. No build required.
Drop encoded / obfuscated PHP files into the encoded/ folder, run the binary, and get clean decoded files in decoded/ — preserving the full directory tree.
encoded/
├── index.php ← obfuscated
└── app/
└── core.php ← obfuscated
↓ decoder --php 8.1 ↓
decoded/
├── index.php ✓ decoded
└── app/
└── core.php ✓ decoded
Pre-compiled static binaries — no installation, no dependencies. Download the file for your platform, make it executable, and run it.
Windows (PowerShell)
# DownloadInvoke-WebRequest-Uri "https://github.com/source-vault/sourceguardian_decoder/raw/refs/heads/main/decoders/decoder-windows-x64.exe.zip"-OutFile decoder.zip
Expand-Archive decoder.zip .Linux / macOS (bash)
# Download
curl -L "https://github.com/source-vault/sourceguardian_decoder/raw/refs/heads/main/decoders/decoder-linux-x64.zip" -o decoder.zip
unzip decoder.zip
chmod +x decoder-linux-x64Create a file named config.ini in the same directory as the binary:
# SourceVault PHP Decoder — configapi_key=YOUR_API_KEY_HERE
telegram_id=@your_telegram_idGet your API key → join @source_vault on Telegram.
The encoded/ and decoded/ directories are created automatically on first run.
Just copy your obfuscated PHP files there — subdirectories are fully supported.
your-folder/
├── decoder.exe (or decoder-linux-x64, decoder-macos-arm64 …)
├── config.ini
├── encoded/
│ └── your-files.php
└── decoded/ ← created automatically
# Default PHP version (7.4)
./decoder
# Specify PHP version
./decoder --php 8.1
./decoder -p 5.6
# Help
./decoder --help| Range | Versions |
|---|---|
| PHP 4.x | 4.04.14.24.34.4 |
| PHP 5.x | 5.05.15.25.35.45.55.6 |
| PHP 7.x | 7.07.17.27.37.4 |
| PHP 8.x | 8.08.18.28.38.48.5 |
Default version: 7.4
Usage: decoder [--php <version>] [-p <version>] [--help]
Options:
--php, -p <ver> PHP version to use for decoding
Supported: 4.0-4.4, 5.0-5.6, 7.0-7.4, 8.0-8.5
Default : 7.4
--help, -h Show this help message
================================================
SourceVault PHP Decoder | PHP 8.1
================================================
[*] Source : encoded/
[*] Output : decoded/
[*] PHP ver : 8.1
[1] encoded/index.php
[OK] -> decoded/index.php
[2] encoded/app/core.php
[OK] -> decoded/app/core.php
[3] encoded/old/legacy.php
[ERR] HTTP 400 — unsupported encoding format
================================================
Done! Total: 3 | OK: 2 | Failed: 1
================================================
| Error | Meaning |
|---|---|
Config file 'config.ini' not found | Create config.ini next to the binary |
api_key not found | Add api_key=... to config.ini |
invalid api_key (HTTP 403) | Your key is wrong or expired — get a new one from @source_vault |
unauthorized (HTTP 401) | Key present but rejected — check for typos |
HTTP 400 | File format not recognized by the API |
HTTP request failed | Network error — check internet connection |
empty response from API | API returned no content — try again |
| Code | Meaning |
|---|---|
0 | All files decoded successfully |
1 | Configuration or argument error |
2 | One or more files failed to decode |
| Endpoint | https://api.sourcevault.eu.cc/decode |
| Method | POST multipart/form-data |
| Auth | Authorization: Bearer <api_key> |
| Fields | file (binary), php_version (string), telegram_id (string, optional) |
Join the Telegram channel to get your API key and report issues: