alert("Hello World!"), which causes a pop-up window to open, is 21 characters long. In JSFuck, the same code has a length of 22948 characters. Certain single characters require far more than 1000 characters when expanded as JSFuck. This section offers an overview of how this expansion works.
The number 0 is created by
 is the empty array and
+ is the unary plus, used to convert the right side to a numeric value (zero here). The number 1 is formed as
+!+, where the boolean value
true (expressed as
!+ in JSFuck) is converted into the numeric value 1 by the prepended plus sign. The digits 2 to 9 are formed by summing
true + true = 2 and
!+, hence 2 can be written as
!++!+. Other digits follow a similar pattern. Integers consisting of two or more digits are written, as a string, by concatenating 1-digit arrays with the plus operator. For example, the string
 + . By replacing the digits with the respective JSFuck expansions, this yields
[+!+]+[+]. To get a numeric value instead of a string, one would enclose the previous expression in parentheses or square brackets and prepend a plus, yielding
Some letters can be obtained in JSFuck by accessing single characters in the string representations of simple boolean or numeric values like
"undefined" with an indexer (a number in square brackets). Other tricks are needed to produce other letters - for example by casting the string
1e1000 into a number, which gives
Infinity, which in turn makes the letter
y accessible. The following is a list of primitive values used as building blocks to produce the most simple letters.
"a": Taken from the string
"false". The second character of "false" is a, which can be accessed with
"false"can be made from
false+, i.e. the boolean constant false plus an empty array.
(false+): We write false as
!(negation applied to an empty array).
(!+): 1 is a number, we can write it as
(!+)[+true]: Since false is
!, true is
(!+)[+!!]- which evaluates to "a".
alert((!+)[+!!]) does the same as
alert(1) is equivalent to
Function constructor can be retrieved in JSFuck by accessing the constructor property of a well known function, such as
Array.prototype.filter). And then
The characters with the shortest JSFuck expansions are listed below. Other characters can be expressed as well but will generate considerably longer code.
Manage research, learning and skills at defaultLogic. Create an account using LinkedIn or facebook to manage and organize your IT knowledge. defaultLogic works like a shopping cart for information -- helping you to save, discuss and share.