Engineering · New
2026-08-03
~7 min read
Does obfuscation break Web Workers and Service Workers?
A worker is a second entry point with its own global scope and no DOM. Here is what that changes about which transforms are safe, why postMessage keys are a contract, and how to test it in ten minutes.
Read article ›
Engineering · New
2026-08-03
~7 min read
Minify before or after obfuscation?
Bundle, minify, then protect — protection runs last. The two wrong orders fail differently, and one of them silently costs you tree shaking while looking perfectly fine.
Read article ›
Threat model · New
2026-08-03
~8 min read
Can browser DevTools deobfuscate your JavaScript?
Pretty-print is a formatter and reverses nothing that matters. The debugger is the real capability. An honest account of what an analyst gets from each, and the one mistake that undoes everything.
Read article ›
Distribution · New
2026-08-03
~8 min read
Should you obfuscate an npm package you publish?
Usually not — a published package is an input to someone else’s build, so you break their tree shaking and your own support workflow. The four cases where it is still right.
Read article ›
Performance · New
2026-08-02
~8 min read
How much bigger does obfuscation make your bundle?
We measured 42 real libraries. Raw output roughly doubles, while the compressed bytes users download grow much less. See the full results, the outliers, and why already-minified input behaves differently.
Read article ›
Engineering · New
2026-08-02
~7 min read
The newline rules that break JavaScript obfuscators
Five restricted productions make a line break change program meaning. These cases can produce valid output with silently wrong values, so they belong in every rewriting tool’s compatibility suite.
Read article ›
Correctness · New
2026-08-02
~7 min read
Does obfuscation preserve “use strict”?
String tables and wrappers can quietly demote a directive prologue. Here is what changes when strict mode is lost and a small runtime probe that verifies the protected result.
Read article ›
Engineering · New
2026-08-02
~6 min read
Obfuscating ES modules: what changes without a bundler
Export names are a public contract, not safe rename targets. Learn what remains protectable behind that module boundary and how to verify that protected .mjs files still link.
Read article ›
Fundamentals · New
2026-07-27
~8 min read
JavaScript obfuscation techniques explained
Obfuscation is not one thing — it is a stack of transforms with different costs. Identifier renaming, string arrays, encoding and encryption, cross-file member renaming, control-flow flattening, and bytecode virtualization: what each removes, what it costs at runtime, and where to apply it.
Read article ›
Troubleshooting · New
2026-07-27
~7 min read
Obfuscated JavaScript not working? The six causes, in order
It ran before protection and breaks after it. Nearly always one of six things — and the first one, a name matched as a string at runtime, accounts for most of them. How to find which, bisect the transforms, and build a repro worth sending.
Read article ›
Operations · New
2026-07-27
~6 min read
How to debug obfuscated JavaScript in production
Don’t ship the source map. Keep each build’s identifier map private, translate field stack traces locally with jso-symbolicate, and run captured Sentry or Datadog events through the matching adapter — no upload, no key in the browser.
Read article ›
Source handling · New
2026-07-27
~6 min read
Is it safe to use an online JavaScript obfuscator?
A textarea is not a sandbox — pasting is uploading. The ten-second Network-tab test that settles it for any vendor, the questions a security reviewer will ask you, and when to move to CI or a local workflow instead.
Read article ›
Design guidance · New
2026-07-27
~7 min read
How to protect a JavaScript licence or trial check
One boolean stands between your paid product and a free one. Move authority to the server, virtualize the validation path, stop concentrating the decision in a single flag, and instrument tampering so a bypass surfaces in a week rather than never.
Read article ›
Legal & Licensing · New
2026-07-21
~5 min read
Is JavaScript obfuscation legal?
Yes — obfuscating code you own or are licensed to modify is legal and routine. The real constraints aren’t obfuscation itself: honor third-party and copyleft (GPL) license terms, respect publishing rules (browser-extension stores forbid it), and remember obfuscation never launders illegal behavior.
Read article ›
Fundamentals · New
2026-07-21
~5 min read
Obfuscation vs encryption: what’s the difference?
Not the same thing. Encryption needs a key to run and is reversible with it; obfuscation runs directly and only raises the cost of understanding. Anything that “encrypts” client-side JavaScript must ship the key to the browser — so it’s really obfuscation with extra steps.
Read article ›
Deployment hygiene · New
2026-07-21
~6 min read
Why does obfuscated JavaScript trigger antivirus false positives?
Because malware pioneered the same techniques — string arrays, eval loaders, packed blobs — so heuristics fire on the shape, not the intent. How to ship protected code that doesn’t get quarantined: avoid eval, serve external files, sign your builds, keep behavior transparent.
Read article ›
SEO · New
2026-07-19
~5 min read
Does obfuscating JavaScript hurt your SEO?
No — Google indexes the rendered page, not your source, so behavior-preserving obfuscation is SEO-neutral. The real rules: keep JSON-LD structured data readable (it’s data, not code), don’t bloat the bundle (Core Web Vitals), don’t block your JS from crawlers, and verify the rendered DOM is unchanged.
Read article ›
Security engineering · New
2026-07-19
~5 min read
Does obfuscation break Content Security Policy?
Old eval-based packers break strict CSP; modern obfuscation doesn’t. String decoding, control-flow flattening, and VM bytecode are ordinary code — no eval, no new Function — so protected output runs under a strict CSP without unsafe-eval. Serve it as an external file and keep your policy strict.
Read article ›
Engineering · New
2026-07-27
~7 min read
How to verify an obfuscator didn’t silently break your JavaScript
Output that parses is not output that works. Arrow functions lose their this, a unary minus fuses into a decrement, a tagged template stops calling its tag — all valid syntax, all wrong answers. A four-rung verification ladder, what each rung can and cannot see, and why diffing against the original beats testing against expectations you wrote yourself.
Read article ›
Performance · New
2026-07-19
~5 min read
Does JavaScript obfuscation slow down your app?
A little, and it’s controllable. Identifier renaming is essentially free; VM bytecode is meaningfully slower by design. The whole game is matching transform strength to hot vs cold paths — protect the once-per-session license check hard, keep the per-frame loop light, and the cost disappears where it matters.
Read article ›
Threat modeling · New
2026-07-19
~5 min read
Is JavaScript obfuscation reversible?
Yes, in principle — obfuscation isn’t encryption, and code that runs can be understood. But that’s the wrong question. What it actually does is raise the cost of reversing; the goal is to price the attacker you have out of reach. The reversal-cost spectrum, where AI/deobfuscators fit, and why measurable resistance beats an “irreversible” claim.
Read article ›
Threat modeling · New
2026-07-19
~5 min read
You can’t hide an API key in JavaScript
A secret shipped to the browser is already public — the browser has to read it, so anyone can. Obfuscation raises the cost of finding a client-side key but can’t make it secret. What actually works (keep it server-side), the NEXT_PUBLIC_ trap, and where obfuscation genuinely helps: your logic, not your secrets.
Read article ›
Deployment hygiene · New
2026-07-19
~5 min read
Your source maps are publishing your source code
A .js.map maps your shipped bundle back to original names — and with inlineSources, the original source text. Ship one beside a protected bundle and you have published exactly what you protected. How to check what you serve right now, why it keeps happening by default, and the one-line deploy fix.
Read article ›
Supply-chain integrity · Shipped
2026-05-28
~7 min read
Watermarks + signed attestations for protected JavaScript
HMAC-SHA256 watermarks that survive every obfuscation transform, Ed25519-signed release attestations with two-stage verify, pre-flight quota gates, bulk forensic scanner. Cross-language verified across Node, Python, and .NET. Wire format is open. Six lines of GitHub Action YAML covers the whole stack.
Read article ›
JSO AI · Phase 1 shipped
Updated 2026-06-06
~5 min read
JSO AI previews and BYO keys are live
Four endpoints, three browser previews, encrypted OpenAI / Claude account keys, Prometheus usage export, JSON Schema, language client snippets, and RSS. Preview mode works without a key; BYO keys turn the same endpoints into live AI for that account.
Read article ›
Maximum Mode · VM Bytecode Beta
Updated 2026-06-06
~8 min read
VM-based protection for selected sensitive functions
Eligible Corporate+ accounts can test bytecode virtualization for small pieces of high-value JavaScript. The design tradeoffs and why it is opt-in per function rather than whole-bundle default.
Read article ›
AI-Aware Research
2026-05-20
~10 min read
CASCADE and the LLM-deobfuscator question
Google’s CASCADE pairs Gemini with a JavaScript IR to deobfuscate at scale. What the paper actually does, where per-build polymorphism alone falls short against prelude-detection, and what’s on the JSO roadmap to answer it.
Read article ›
Resistance Score · Planned
2026-05-20
~8 min read
The Resistance Score: planned evidence for AI-resistance claims
Every obfuscator markets “AI-resistant,” almost none ship a way to check it. The artifact JSO is designing to make the claim reviewable: a named adversarial probe, a source-free report, and recovery categories.
Read article ›
AI-Aware Research
2026-04-25
~9 min read
Can ChatGPT, Claude, or Copilot reverse-engineer obfuscated JavaScript?
A direct technical answer for 2026. What today’s AI assistants can actually deobfuscate, where they break down structurally, and why per-build polymorphic decoders disrupt the pattern-matching approach LLMs rely on.
Read article ›