What is the JSE file format?
Files with a .jse extension store JScript code obfuscated using Microsoft Script Encoder - a tool Microsoft shipped with Windows Script Host 2.0 in 1999. The underlying language is JScript, Microsoft's Windows-specific dialect of JavaScript (ECMAScript), but the source has been run through a proprietary substitution-cipher encoding that conceals the plaintext from casual inspection.
How to run a .jse file
Microsoft Windows includes Windows Script Host (wscript.exe / cscript.exe), which can be used to run scripts in .jse files. Windows Script Host decodes the obfuscation and executes the JScript at runtime. .jse scripts can also be run directly from the command line using cscript myscript.jse.
Is running .jse scripts safe?
Unlike browser JavaScript, JScript scripts running under Windows Script Host have direct access to the file system, Windows registry, network connections, and COM automation objects - there is no sandbox. The Script Encoder obfuscation is trivially reversible and provides zero real protection; multiple open-source decoders exist online. Running unverified or untrusted .jse files is strongly discouraged. Because the encoding helps evade plain-text signature detection, .jse is almost exclusively associated with malware delivery today. Many organizations disable Windows Script Host for standard users or block .jse files at the email gateway entirely. Compare with .VBE - the equivalent encoded VBScript format.
Security & safety
RISK: HIGHJSE is one of the most common malware delivery formats on Windows. Windows Script Host executes .jse files immediately on double-click with no sandboxing, and the obfuscation is designed to evade signature-based AV. Never open a JSE file received via email, messaging, or downloaded from an untrusted site. If you must inspect one, decode it first (never run the original) and read it in a text editor in a sandboxed VM. Organisations should disable Windows Script Host via Group Policy or registry (HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled = 0) and block .jse in email filters. APT32, Kimsuky, FIN6, FIN7, Cobalt Group are documented JSE users.
Format details
in a nutshellPrograms that open JSE files
Windows3 apps
Microsoft Windows Script Host (wscript.exe / cscript.exe)
Built-in Windows executes .jse natively on double-click via wscript.exe. WARNING: only run .jse files from trusted, verified sources - this executes the script immediately.
Notepad++ (after decoding)
Open-source To INSPECT (not run) a JSE file: first decode it using a Script Encoder decoder (e.g. the Windows Script Decoder on GitHub), then open the decoded .js in Notepad++ to read the source.
Microsoft Visual Studio (script debugging)
Freemium Can be used to debug WSH scripts, but the .jse must be decoded first to debug meaningfully. Technical details
deep spec| Format type | Microsoft JScript (ECMAScript dialect) obfuscated with Microsoft Script Encoder |
| Obfuscation method | Substitution cipher - not encryption; reversible without a key. Multiple open-source decoders exist. |
| File signature | ASCII sequence `#@~^` at offset 0, followed by an encoded script-length field |
| Text encoding | 7-bit ASCII with proprietary Script Encoder character substitution applied on top |
| Execution environment | Windows Script Host (`wscript.exe` / `cscript.exe`) on all Windows versions from XP through 11 |
| Underlying language | JScript - Microsoft's ECMAScript dialect for Windows automation (COM, WScript, FileSystemObject) |
| Typical file size | 1 KB - 500 KB (varies with script complexity) |
| MIME type | `application/x-javascript` (also `text/jscript`) |
| Security risk | Extremely high - executes natively on double-click; almost exclusively used for malware delivery in practice |
| Checksum | Encoded block contains a validation byte; not a cryptographic integrity mechanism |
| Introduced | 1999, with Microsoft Script Encoder and Windows Script Host 2.0 (Windows 98 SE / Windows 2000) |
| OS compatibility | Windows XP through Windows 11 (any Windows version with Windows Script Host) |
| Related formats | `.js` (plain JScript source), `.vbe` (VBScript Encoded equivalent) |
| Superseded by | Plain `.js` with minification/bundling (web); PowerShell `.ps1` scripts (Windows automation) |
| Released | 1999 (Microsoft Script Encoder / Windows Script Host 2.0, Windows 98 SE / Windows 2000) |
| Latest version | N/A - Script Encoder tool discontinued; format still executed by Windows Script Host on all Windows versions |
| Specification | learn.microsoft.com |
JSE conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about JSE files.
