npm CLI

A JavaScript obfuscator CLI for npm, Node.js and CI

npx javascriptobfuscator-com protects one file, a whole build folder or standard input. With no account the free options run on your own machine — nothing uploaded, no rate limit, no size cap — and the same command takes paid presets once you have a plan. No dependencies; Node.js 18 or later.

Run It Now Full CLI Reference
Without An Account

What runs where

The CLI picks the engine for you and tells you which one it used.

Local, freeRename locals, encode strings
Hosted, paidCompressor, flattening, defences, VM
Your choice--engine local or --engine hosted
First Run

Protect a file in one command

Run it without installing anything; add it to devDependencies when it becomes part of your build.

Terminal
npx javascriptobfuscator-com app.js
# writes app-obfuscated.js beside it

npm install --save-dev javascriptobfuscator-com
What the CLI prints with no account
No credentials found - protecting on this machine with the
free engine (local renaming + string encoding).
Nothing is uploaded and there is no rate limit. Output carries
a short header naming this product.

Protected 1 file(s) and copied 0 asset(s) into app-obfuscated.js
Commands

The commands you will use most

Run with npx javascriptobfuscator-com (or npx javascriptobfuscator once installed). Every line below was run against the published 0.5.0.

TaskCommand
One file, output beside itapp.js
One file, chosen outputapp.js protected/app.js
A build folder--input dist --output dist-protected
A build folder, in place--input dist --output dist
Pipe through stdin--stdin --stdout --file-name app.js < app.js
See what would run--input dist --output dist-protected --dry-run
Node.js code--target node
Skip files--exclude "**/vendor/**" (repeatable)
Keep a public name--reserved-name "^initWidget$" (repeatable)
Paid preset--preset standard, balanced or maximum
Single option--option EncryptStrings=true (repeatable)
Never upload--engine local
Write a config file--init
Sign in on this machinenpx javascriptobfuscator login
Convert a javascript-obfuscator config--migrate-javascript-obfuscator options.json --output jso.config.json

Asking for a paid option with --engine local stops with a clear message rather than silently skipping it: “--engine local runs only the free transforms (local renaming and string encoding). Remove FlatTransform, or use the hosted engine.” Not sure which options you want? Choose them in the online tool and press Copy as CLI command.

Node.js

Obfuscate Node.js code with --target node

In a browser script, top-level names are globals other scripts may use, so they are kept. Node wraps every file in a module function, so with --target node the CLI renames them too, while keeping require() specifiers and the keys of module.exports.

server.js — default
const crypto=require("crypto");function signToken(b,c){const a=b+"\x3a"+Date.now();const d=crypto.createHash("\x73\x68\x61\x32\x35\x36").update(a+c).digest("\x68\x65\x78");return a+"\x2e"+d.slice(0,16);}module.exports={signToken};
server.js — --target node
const a=require("crypto");function b(c,d){const b=c+"\x3a"+Date.now();const e=a.createHash("\x73\x68\x61\x32\x35\x36").update(b+d).digest("\x68\x65\x78");return b+"\x2e"+e.slice(0,16);}module.exports={signToken: b};

Both versions still load with require() and export a working signToken. The seven-line comment that opens free output is left out above. Obfuscating server code that never leaves your servers is rarely worth it; it matters for code you hand to others — CLIs, on-premises installs, Electron apps. See protecting Node.js source code for what else to consider, and why compiling Node to a binary is not obfuscation.

CI

In a build pipeline

GitHub Actions step
- run: npm ci && npm run build
- run: npx javascriptobfuscator-com --input dist --output dist --preset standard
  env:
    JSO_API_KEY: ${{ secrets.JSO_API_KEY }}
    JSO_API_PASSWORD: ${{ secrets.JSO_API_PASSWORD }}

What to know before you add it

  • Credentials come from the environment (JSO_API_KEY, JSO_API_PASSWORD), so they live in CI secrets, never in the repository.
  • A missing secret fails the step. A paid preset without credentials stops with a plan error instead of shipping weaker output. Leave out --preset to run the free preset locally on purpose.
  • A config file keeps commands short: --init writes jso.config.json, and --config jso.config.json reads it.
  • --manifest records what was protected, with hashes, for release evidence.
  • The CI generator in the docs writes a full workflow for you.
Inside Your Bundler

Prefer a plugin to a separate step?

The same package includes build plugins, each tested with a real build: Rollup, esbuild, Rspack and Rsbuild, Parcel and Gulp. The CLI reference lists every integration and option.

Frequently Asked

JavaScript obfuscator CLI questions

Is there a free JavaScript obfuscator CLI?

Yes. npx javascriptobfuscator-com runs with no account: it renames local variables and encodes string literals on your own machine, with no upload, no rate limit and no size cap. The output starts with a short comment naming the product; paid plans remove it and add the hosted transforms.

Does the CLI upload my code?

Not for the free options when no credentials are configured; the CLI says so when it starts. Paid options, JSX or TypeScript input, or an API key send the files to the hosted engine. --engine local guarantees nothing is uploaded; --engine hosted always uses the hosted engine.

How do I obfuscate Node.js code from the command line?

Add --target node. Node wraps every file in a module function, so the CLI can then rename top-level names too; require() specifiers and module.exports keys are kept so the module still loads.

How is it different from the javascript-obfuscator npm package?

javascript-obfuscator is an open-source library that runs entirely on your machine. javascriptobfuscator-com runs this site’s engine: free options locally, paid transforms such as the Compressor, flattening, runtime defences and VM protection on the hosted engine. The two compared; the CLI converts a javascript-obfuscator options file with --migrate-javascript-obfuscator.

Next Step

Pick options visually, run them from the CLI

The online tool previews every option on your own code and exports the matching command or jso.config.json.

Open the Online Tool › How to Obfuscate JavaScript