Paste a non-sensitive JavaScript sample, choose the free preset, and generate protected output without signing up. This online tool sends your input to our hosted service; it does not run protection only in your browser. Download the result and test it in your application before publishing.
Review source handling or compare obfuscators using the same application. For private source or batch projects, review the desktop app's local and hosted modes before choosing a workflow.
Generating output is the first check, not a compatibility guarantee.
Follow the compatibility checklist. Choose a paid plan only when its capacity or features match your release needs.
Paste or upload a representative sample, generate output, and check it in your application. For a larger test, review desktop or CLI limits and plan requirements.
Start with the shopping-cart example below. Standard is the starting configuration; Balanced adds more transformations in this limited online evaluation. More complex-looking output is not a security or compatibility guarantee.
Options changed after this output was made. Press Obfuscate to update it.
Line breaks and indentation in the protected output.
Protection options, including Encode Strings, Move Strings and Replace Names, are in Advanced Transforms.
Free evaluation of premium transforms on samples up to 32 KB. A plan badge (Basic, Corporate, Enterprise) marks an option your own account, the CLI and the API need that plan for.
Cross File Obfuscation and Protect Members are not applied on this single-file page; use the desktop app or CLI. Other selected advanced transforms run in the 32 KB evaluation.
Regex per line. Names matching any pattern are kept.
Use one pattern per line for public APIs, framework hooks, or names that should stay stable across builds.
Next, verify behavior in your application.
.js
.js/.jsx
Yes, the online tool is free and needs no account to try. It is a demo of the protection engine rather than a production pipeline, so it carries deliberate limits: samples are capped at 32 KB, pasted or uploaded, and the endpoint is rate limited. Options that need additional values or desktop-only processing are not applied to the preview. For larger evaluations, use the desktop app or npm CLI after checking that workflow's request limits, rate limits and plan requirements.
It is sent to the hosted service, used to generate your protected result, and the temporary upload file is removed after completion. If you would rather not send source anywhere, the local paths exist for that reason: WinUI Local Standard protects basic ES5 JavaScript entirely offline, and paid Local Advanced keeps modern JavaScript and mixed HTML or server-script source on your own device after an online entitlement check. The security processing documentation describes each path in detail.
Usually one of three things. The online demo protects up to 32 KB of source. It skips options that need additional configuration values or desktop-only processing (Protect Members, Cross File Obfuscation). And some options only work together with another: Flat Transform and Dead Code Insertion need Code Transposition or Compressor; Short Local Name, Deep Obfuscation and Replace Globals need Replace Names; Encrypt Strings and Move Members need Move Strings. The page turns the needed option on for you, and after each run it lists what was applied, what had no effect and why. Run the same input through the desktop app or the CLI to see the full result.
It can be analysed, and no client-side protection changes that, because the browser has to execute the code you sent it. What protection changes is cost. Automated formatters restore whitespace and structure but cannot restore the names, string layout and control flow that were rewritten, so the work of understanding a protected bundle well enough to fork and maintain it is substantially larger than reading a minified one. Treat it as raising cost, not as a boundary.
It can, so test the protected output before release. Preserve names used by external code, and verify framework callbacks, dynamic imports, browser policies and other integrations. Excluding names alone does not guarantee compatibility.
It removes the demo limits and adds the workflows a real release needs: whole folders rather than a single snippet, mixed HTML and server-script files where the script is protected in place and the surrounding markup is left untouched, local processing that keeps source on your machine, and protection reports written locally for later symbolication. The npm CLI covers the same ground for Node-based builds and CI.