Understanding JSFuck: Writing Executable JavaScript with Only []()!+ Characters

Last week a friend posted a piece of code that could run directly in the browser; the trick is that the entire script can be expressed using only the six characters []()!+ . By exploiting JavaScript’s weak typing and implicit conversions, these characters can produce booleans, numbers, strings, and ultimately any executable code.

Type Conversion

JavaScript automatically converts values in expressions. The operators ! , + , and +[] respectively coerce a value to boolean, number, and string. For example:

false       => ![]
true        => !![]
undefined   => [][[]]
NaN         => +[![]]

Numbers

Numbers are built from these conversions: +[] yields 0 , +!+[] yields 1 , and adding !+[] repeatedly produces larger integers (e.g., !+[]+!+[] equals 2 ). Larger numbers can be formed by concatenating string representations and converting back to numbers.

Letters

Strings such as 'undefined' are obtained via [][+[]]+[] . Individual characters are accessed by indexing, e.g., ('undefined')[0] === 'u' . Similar techniques retrieve characters from 'false' to build words like 'find' .

Methods and Constructors

By concatenating characters, method names are reconstructed (e.g., 'f'+'i'+'n'+'d' === 'find' ). Accessing []['find'] yields the array find method, whose constructor is the Function object. Thus []['find']['constructor'] gives Function .

Executing Arbitrary Code

The Function constructor can create a new function from a string: Function('alert(1)')() . By retrieving Function via the find method’s constructor, any string can be turned into executable code without directly typing the word Function .

Full JSFuck Example

The complete expression that evaluates alert(1) is a massive combination of the six characters, for instance:

[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[!+[]+!+[]+!+[]]]+[+!+[]]+([+[]]+![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[!+[]+!+[]+[+[]]])()

The online tool jsfuck.com can automatically generate such code from any JavaScript snippet.

With these techniques, developers can understand the inner workings of JSFuck, appreciate JavaScript’s type coercion quirks, and even create highly obfuscated scripts for fun or security research.