Code Obfuscator

Online code obfuscator for JavaScript

A code obfuscator rewrites a program so it still runs exactly as before but is much harder for a person to read, search or reuse. This one protects JavaScript — plain files, minified bundles, modern ES2015+ code, and scripts embedded in HTML, PHP and ASP pages. Paste a sample online for free, or run the same engine in your build.

Obfuscate Code Online How Obfuscation Works
Free To Start

No account, no download

The online obfuscator protects samples up to 32 KB and lets you preview every option before choosing a plan. The npm CLI runs the free options on your own machine with no sign-up, no upload and no size cap.

OnlinePaste, pick a preset, copy.
CLIProtect build output in CI.
DesktopFolders and mixed files.
What An Obfuscator Changes

Same behaviour, different code

Here is a real before-and-after from this obfuscator: names replaced, strings moved into a table and encoded. Both versions print the same result when run.

Before
function isLicensed(user) {
  var plan = user.plan;
  if (plan === "pro" || plan === "team") {
    return user.key !== "TRIAL-KEY";
  }
  return false;
}
After (formatted for reading)
var _$_2476=["\x70\x72\x6F","\x74\x65\x61\x6D",
  "\x54\x52\x49\x41\x4C\x2D\x4B\x45\x59"];
function isLicensed(b)
{
	var a=b.plan;
	if(a=== _$_2476[0x0]|| a=== _$_2476[0x1])
	{
		return b.key!== _$_2476[0x2]
	}
	return false
}

Names lose their meaning

Variables, parameters and, if you choose, global functions get short generated names. Anything other code calls by name can be kept with an exclusion rule.

Strings stop being searchable

Literals are moved into a table, encoded, and optionally encrypted, so endpoints, messages and keys no longer appear as plain text in the file.

Structure stops reading top to bottom

Code transposition, flat transform and dead-code insertion restructure the program so its logic cannot be followed in one pass.

Every transform, step by step with real output: how to obfuscate JavaScript.

What You Can Obfuscate Here

JavaScript, wherever it lives

Files and bundles

Plain .js, minified production bundles, and modern ES2015+ code, either kept modern or down-levelled to ES5.

Framework and TypeScript output

The JavaScript a TypeScript, React, Angular or Vue build emits — protected after the build, never before it.

Scripts inside pages

JavaScript embedded in HTML, PHP, ASP, ASPX and JSP files, protected in place while the surrounding markup and server code are left alone (desktop app and CLI).

Not The Same Tool

Obfuscator, minifier, encryptor, deobfuscator

Four tools that get confused with each other, and what each is actually for.

ToolGoalUndone by a formatter?
ObfuscatorMake code hard to understand and reuse while it still runs.No: names, strings and structure stay rewritten.
MinifierMake files smaller and faster to load.Mostly: whitespace and layout come back.
EncryptorHide data from anyone without the key.Not applicable: code a browser runs cannot stay encrypted, so the key ships too.
DeobfuscatorMake obfuscated code readable again.It is the formatter's more ambitious cousin.

More on the first two: minification vs obfuscation.

Other Languages

Need an obfuscator for something other than JavaScript?

This site protects JavaScript. Our sister products cover the other common cases:

.NET assemblies

C#, VB.NET and F# compile to assemblies that decompile back to near-source. Free .NET Obfuscator protects .exe and .dll files online.

Python

Python ships as readable source or easily decompiled bytecode. Python Obfuscator covers it.

Reading obfuscated JavaScript

Going the other way — auditing a script you did not write? JavaScript Deobfuscator is built for that.

Choosing An Obfuscator

Five questions worth asking

  • Does the output still run? Test a protected copy of your real build, not a toy sample.
  • Can you keep the names you must? Public APIs and framework hooks need exclusion rules.
  • Where does your code go? Hosted services see your source; some workflows need a local option.
  • Does it fit your build? A CLI or CI step matters more than a web form once you ship regularly.
  • Is the price published? Compare plans before a sales call, not after.

A side-by-side of the main JavaScript options: best JavaScript obfuscator comparison.

What It Cannot Do

Limits of any obfuscator

  • It does not hide secrets. A key in front-end code is readable however it is protected.
  • It does not replace server checks. Whoever runs the code controls it.
  • It raises cost, not walls. Analysis gets slower and harder, not impossible.

See what can break and how to test for it.

Frequently Asked

Code obfuscator questions

What does a code obfuscator do?

It rewrites source code so it behaves the same but is much harder for a person to read: identifiers get meaningless names, string literals are moved, encoded or encrypted, and control flow is restructured. The program's behaviour should not change, which is why protected output must still be tested.

Is there a free online obfuscator?

Yes. The online JavaScript obfuscator needs no account and protects samples up to 32 KB, with every option available to preview. The npm CLI runs the free options on your own machine with no account, uploading nothing.

Which languages can this obfuscator handle?

JavaScript: plain and minified files, modern ES2015+ code, the JavaScript a TypeScript or framework build emits, and JavaScript embedded in HTML, PHP, ASP, ASPX and JSP pages. For .NET assemblies and Python, use the sister obfuscators above.

Is an obfuscator the same as a minifier?

No. A minifier makes files smaller and a formatter can undo most of what it does. An obfuscator aims to make code hard to understand; it can make files larger, and formatting does not restore original names, strings or structure.

Can obfuscated code be reversed?

Code that runs on someone else's machine can always be analysed. Obfuscation makes that slower and more expensive; it does not make secrets safe to ship or replace checks on the server.

Can I run it without uploading my code?

Yes, for the free options: with no account the npm CLI renames identifiers and encodes and moves strings on your own machine and uploads nothing. Paid options, and the online tool, use the hosted service. The Windows desktop app's Local Standard mode also protects basic ES5 files offline; see how code is handled for each path.

Try It

Obfuscate a sample in under a minute

Paste any JavaScript, pick a preset, and compare the output. The report under the result lists what was applied and which options need a paid plan.

Open the Online Obfuscator › See Plans