Legal & Licensing
Yes. Obfuscating JavaScript that you own, or that you are licensed to modify, is legal — and it’s an ordinary, widely used software-protection measure, the same category as minification or compiling to a binary. There is nothing inherently suspicious about shipping code a human can’t easily read; most compiled software has been unreadable for decades. The questions worth asking aren’t about obfuscation itself — they’re about whose code you’re obfuscating and where you’re publishing it.
This article is general information, not legal advice. Laws vary by jurisdiction and by the specific licenses you’ve agreed to. For a real decision, check your license terms and, when it matters, ask a lawyer.
Obfuscating your own code is unambiguously fine
If you wrote the JavaScript, or your company owns it, you can transform it however you like before shipping it. Obfuscation doesn’t change what the program does; it changes how readable the source is. That’s your prerogative as the copyright holder. Protecting proprietary logic from casual copying is one of the main reasons obfuscation exists, and it’s exactly why commercial software has shipped in non-human-readable forms — compiled binaries, bytecode, stripped symbols — for as long as commercial software has existed.
The real constraint #1: third-party and open-source licenses
The one place obfuscation gets you into genuine trouble is when the code isn’t entirely yours. Bundle in a library and you inherit its license terms:
- Copyleft licenses (GPL, AGPL, LGPL). The GPL family requires that you convey the corresponding source — the preferred form for making modifications. Shipping only an obfuscated blob of GPL-covered code, with no readable source available, is a license violation. The GPL FAQ is explicit that obfuscated code is not a valid substitute for source. This is a licensing problem, not an “obfuscation is illegal” problem, but the practical effect is the same: don’t obfuscate copyleft code into a shipped bundle without honoring the source-availability terms.
- Permissive licenses (MIT, BSD, Apache-2.0). Generally fine to obfuscate, but most require you to preserve the copyright and license notice. An aggressive obfuscator that strips comments will remove that notice — so you need to re-attach required attributions (a separate
LICENSE/NOTICE file, or a preserved banner comment) to stay compliant.
- Proprietary third-party SDKs. Some commercial licenses forbid modifying or obfuscating the vendor’s code. Read the terms before running someone else’s SDK through an obfuscator.
The clean pattern: obfuscate your application code, keep third-party dependencies as separate, license-compliant bundles, and preserve required notices.
The real constraint #2: where you publish it
Some distribution channels have their own rules about obfuscated or hard-to-review code — this is policy, not law, but it can get your submission rejected:
- Browser extension stores. Chrome Web Store policy prohibits obfuscated code in submitted extensions (minification is allowed; obfuscation designed to conceal behavior is not). If you’re shipping an extension, protect the sensitive parts server-side rather than obfuscating the client bundle. See protecting browser-extension JavaScript.
- App stores (Apple, Google Play). These generally allow obfuscation of your own code but require that your app’s behavior be reviewable and that you not hide prohibited functionality. Obfuscation used to sneak past review is a policy violation; obfuscation used to protect legitimate IP is normal.
- npm and package registries. No rule against publishing obfuscated packages, but consumers distrust them — see obfuscation and npm packages.
The real constraint #3: intent and content
What’s illegal is never the obfuscation — it’s using it to conceal something that’s already illegal. Obfuscating malware, hiding an unauthorized data-exfiltration script, or disguising code that violates consumer-protection or privacy law doesn’t become legal because it’s obfuscated, and it doesn’t become illegal because it is. The obfuscation is neutral; the underlying conduct is what a court or regulator judges. If your code is lawful in the clear, it’s lawful obfuscated.
The short version
Obfuscating code you own or are licensed to modify is legal and routine. Watch three things: honor the license terms of any third-party or copyleft code you bundle, respect the publishing rules of the channel you’re shipping to (browser-extension stores are the strict one), and remember that obfuscation never launders illegal behavior. Get those right and JavaScript obfuscation is exactly what it looks like — a standard way to protect your own intellectual property.