Using Help

Compress into one line Remove line breaks from code.
Identifier obfuscation mode

Set the confusion mode of variable name and function name.

dictionary

Use from Identifier dictionary Name in

hexadecimal

Randomly generated using hexadecimal mode (for example: 0xabc123 )

mangled

Use a short name (for example: a , b , c , etc...)

Identifier dictionary

Set the name dictionary of identifier confusion.

Identifier prefix

Set the confused identifier to use a specific prefix

Configure this option when multiple files loaded on the same page are confused. Using a different prefix for each file helps avoid conflicts between the global identifiers of these files.

Confusing global variables

Enabling this option may affect the operation of other codes. Please use it with caution!

When enabled, global variables and global function names will be confused.

Self protection

When enabled, the encrypted code cannot be formatted. If someone tries to format the encrypted code, the code will not work properly.

When this option is enabled, the code will be forced to be compressed into one line.

Control flow flattening

This option affects performance very much. Please turn it on as required!

Flatten the code control flow. Control flow flattening is a source code structure transformation that hinders program understanding. visit JavaScript's obfuscator GH page Page to understand its principle.

Control flow flattening threshold

Adjustment range: 0~1, the higher the value, the more difficult the code reading is, but the output code running efficiency is correspondingly lower. It can be adjusted as required.

Dead code injection

Enabling this option will result in a larger amount of encrypted code.

Random insertion of meaningless code into the code (which will not be run) makes code decryption more difficult.

Dead code injection threshold

Adjust the threshold of dead code injection (range: 0~1)

Enable this option at the same time Convert string to array Function.

Split String

Enabling this option will result in a larger amount of encrypted code.

Follow the text string Split string block length The set value is divided.

Split string block length

Use this option to specify the length of the block after the string is split.

Convert string to array

Remove the fixed string text in the code and put it in an array. for example var m = "Hello World"; The "Hello World" in will be replaced by a function call, and this value will be retrieved at runtime. An example: var m = _0xb0c3('0x1');

Scramble string array positions

Put the string array in a random location. If you have a large amount of original source code, it is recommended to enable this option to greatly improve the difficulty of code decryption.

Disrupt string array sorting

Randomly arranges the contents of a string array.

Encrypted string array

When enabled, the code running efficiency will be slightly reduced.

Encrypt strings using Base64 or RC4. RC4 encryption is difficult to decrypt after encryption, but the code operation efficiency after encryption is 30-35% lower than that of Base64 encryption. Please select as required.

String to array threshold

You can use this setting to adjust the probability of inserting string text into the string array (from 0 to 1). This setting is useful in large code libraries because repeated calls to string array functions can slow down code speed.

Convert string to Unicode

Converts all strings to their Unicode form. For example, string "Hello World!" Will be converted to "'\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x21" .

This is too easy to decode. It's meaningless. It's not recommended to open it. The code size will be increased after opening.

Disable console output Disabled by overriding to an empty function console.log , console.info , console.error and console.warn
Disable console debugging

When enabled, the browser will be frozen if the browser console is opened.

This will make it unavailable to others Console Debugging tool for code debugging (supports Google Chrome and Mozilla Firefox browsers).

Commissioning protection timer

After starting, a timer will be used to block the console, so that the console cannot be debugged.

Domain name lock

The domain name is not qualified by default. If a locked domain name is added, the encrypted code can only run under the locked domain name

How to add multiple whitelist domain names or subdomains:

If necessary example.com All subdomains of are set as whitelist domain names, add .example.com OK.

reserved identifier

The identifiers in the whitelist will not be confused. Regular expressions are supported.

For example, add ^someName Then all someName The starting variables, function names, and function parameters will not be confused.

Reserved string

ditto.

Source Map

Please make sure not to embed Source Map in the production environment, because the source code can be found through it, leading to the loss of meaning of encryption.

Source maps can help you debug JavaScript code. If you have to debug in production, you can upload a separate Source maps file to a secret location, and then point the browser to that location.

Inline Source Map

Embed Source maps into the results of obfuscation code. It is useful if you need to debug locally.

Separate Source Map

Generate a separate file from Source maps together. This is useful for debugging code in production, because it allows you to upload Source maps to a secret location on the server, and then set the browser to point to that location.

use Source Map Base URL and Source Map File Name Self definition sourceMappingURL And append to the end of the encrypted code.

For example, if you set Base URL by " http://localhost:9000 " Set at the same time Source Map File Name by "example" , will eventually //# sourceMappingURL= http://localhost:9000/example.js.map Append to the end of the encrypted code.

Encrypt Seed

By default (when the seed is set to "0"), every time the same code is encrypted, the results are different (the order of variable names and strings will be different).
If you need to keep the encryption result of the same code consistent every time seed Set the value to a fixed integer.

Operating environment

Set where the encrypted code needs to run

  • Browser
  • Browser No Eval
  • Node

current browser and node Options are handled the same way.

default options

The tool has several preset protection options, which can be selected as required.

Basic protection

Default presets, high performance

Low level protection

Low confusion, high performance, performance will be at a relatively normal level

Intermediate protection

Medium confusion, best performance, performance will be slower than no confusion

Advanced protection

High confusion, low performance, performance will be much slower than no confusion

common problem

Is this obfuscator absolutely foolproof?

No, although it is impossible to recover the exact original code, people with time, knowledge and patience can reverse engineer it.

Since JavaScript runs on the browser, the browser's JavaScript engine must be able to read and interpret it, so this cannot be prevented. Any JavaScript encryption that promises to be unbreakable is deceptive

Why is the confused code larger than the original source code?

Because the obfuscator introduces new code fragments, which are designed to protect and defend debugging and reverse engineering. In addition, strings are converted to hexadecimal code to make the code more difficult to understand. You don't have to worry too much about code size, because there are many duplicates, so your Web server will compress the confused code well (if you enable GZIP compression on the server).

Can I run mini compilers such as UglifyJS or Google Closure Compiler on obfuscated output?

This is not recommended. In some cases, it may break the code (for example, if you enable Self protection )。 However, you can run the code through the minifilter first to ensure that it removes dead code and performs other optimizations.

Will you store my source code?

Absolutely not! This tool encrypts all the time on the browser side and does not transmit any data to the server side. If you are still worried, you can disconnect the network and encrypt after the tool is loaded.

Can I recover the original source code from the confused source code?

No, it is impossible to restore the confused code to the original code, so please keep the original code safe.

Is this tool applicable to Node.js source code?

yes.

I want to run the obfuscator on my own server/machine. OK?

sure. This tool uses a free open source (BSD-2-Clause license) obfuscator written in TypeScript. You can go to Its GitHub page And read more there.

There are also many plug-ins, such as: webpack-obfuscator gulp-javascript-obfuscator and grunt-contrib-obfuscator