JavaScript Obfuscator

Obfuscation rewrites your code into something functionally identical and extremely tedious to read. It raises the cost of casual copying and tampering — and it is important to be clear that raising the cost is all it does.

What obfuscation can and cannot do

Anything the browser runs, the user can read. That is not a flaw in your setup; it is how the web works. Obfuscation does not encrypt your code, because the browser would need the key, and the key would have to be in the page.

What it genuinely achieves is deterrence. A competitor idly viewing source gives up. Someone lifting a widget wholesale has a much harder time adapting it. A determined analyst with time and a debugger will get there regardless. Price your expectations accordingly: this is a speed bump, not a lock.

Obfuscating your script

1. Paste the JavaScript you want to protect.
2. Choose how aggressive the transformation should be.
3. Obfuscate.
4. Test the output thoroughly — more thoroughly than you think you need to.
5. Deploy the obfuscated version and keep your readable source safe.

Techniques obfuscators use

• Name mangling — renames variables and functions into meaningless identifiers.
• String encoding — moves string literals into an encoded array so they cannot be searched for.
• Control flow flattening — rewrites the logic into a state machine, destroying the readable structure.
• Dead code injection — adds branches that never execute, to waste an analyst’s time.
• Self-defending code — breaks if it is reformatted, to frustrate automatic beautifiers.

The costs you are accepting

• A significantly larger file, often two to five times the original size.
• Slower execution, particularly with control flow flattening.
• Stack traces that are effectively useless for debugging production issues.
• A real chance of subtle breakage that only appears in one browser.
• Antivirus and security scanners sometimes flag heavily obfuscated scripts.

Obfuscation questions