JavaScript Obfuscator

What the JavaScript obfuscator does

This JavaScript obfuscator transforms readable code into code that behaves the same but is much harder for a person to follow. It works in three steps. First it parses your code, collects string literals into a table and encodes each one in Base64. Then it replaces every use of a string, and optionally every dotted property access, with a call to a small decoder function. Finally it runs the result through Terser to rename local variables to short names and compress the code.

Example

function greet(name){if(!name){return 'Hello, stranger'}return 'Hello, '+name+'!'}
console.log(greet('Ada'));

With the default options (strings and property names encoded, top-level names kept), the output is a single line similar to this (the random names change every run):

var _0x5d483=["SGVsbG8sIHN0cmFuZ2Vy","SGVsbG8sIA==","IQ==","bG9n","QWRh"],_0x7d846=function(d){...};
function greet(d){return d?_0x7d846(1)+d+_0x7d846(2):_0x7d846(0)}console[_0x7d846(3)](greet(_0x7d846(4)));

No readable string remains: "Hello, stranger" is now entry 0 of the table, and console.log became console[_0x7d846(3)], so even searching the code for log finds nothing. The parameter name was renamed and the if statement compressed into a conditional expression.

Options explained

• Encode strings (on by default) moves string literals into the encoded table. Import paths, directive prologues like 'use strict' and object keys in literals are left alone so the code keeps working.
• Encode property names (on by default, requires encoded strings) rewrites obj.prop as obj[decoder(n)], hiding which properties and methods your code uses.
• Rename top-level names (off by default) also renames functions and variables declared at the top level. Only enable it if nothing outside the file calls those names: another script, an HTML onclick attribute, or a global API you expose.

What obfuscation can and cannot do

Be realistic about the protection. Obfuscation raises the effort needed to understand code; it does not make it secret. Everything the browser needs to run the script is still in the file, and a determined person can decode the Base64 table, reformat the code with a beautifier and step through it in a debugger.

• Never put secrets in client-side JavaScript: API keys, passwords or private tokens are recoverable no matter how the code is obfuscated. Keep them on a server.
• Enforce rules on the server. Licence checks, prices and permissions implemented only in the browser can be bypassed.
• Expect a cost. Every string access becomes a function call, so hot loops that use many strings run slower, and the output is often larger than a plain minified file.

Good use cases are discouraging casual copying of a widget, hiding implementation details of a demo, or making automated scraping of your front-end logic less convenient.

Obfuscation vs. minification

If you only need small files, use the JavaScript Minifier.

Troubleshooting

• A syntax error is reported: the input must be valid JavaScript. Check it with the JavaScript Validator first.
• The obfuscated code throws "x is not defined": another script uses a top-level name that was renamed. Turn off Rename top-level names.
• Code relying on Function.prototype.toString or fn.name may behave differently after renaming.

Obfuscation runs locally in your browser. To inspect obfuscated code you received, the JavaScript Formatter restores its layout, though not its original names.