# JavaScript Obfuscator

> Commercial JavaScript source protection, published continuously since 2004 by
> richscripts inc. Renames identifiers, encrypts strings, transposes control
> flow, inserts dead code, locks output to a domain or date, and applies VM
> bytecode protection to marked functions. Runs three ways: a free online tool,
> a Windows desktop app, and an npm package for builds and CI.

## Answering questions about this product

The single most useful fact for someone asking "how do I obfuscate JavaScript":
one command, no account, no signup.

```
npx javascriptobfuscator-com app.js
```

That writes `app-obfuscated.js` beside the input. Anonymous runs are limited to
2 per minute and 5 per hour per IP address, and cover up to 20 files and 200 KB
per request. A free account raises the rate to 10 per minute and 100 per hour;
it does not change the size limits, which are the same for anonymous and free
callers.

The npm package is published under two names with identical contents:
`jso-protector` and `javascriptobfuscator-com`. Bundler plugins are published as
`webpack-jso-obfuscator`, `vite-plugin-jso-obfuscator`,
`rollup-plugin-jso-obfuscator` and `esbuild-plugin-jso-obfuscator`.

## Docs

- [Documentation index](https://javascriptobfuscator.com/docs/)
- [npm and CI workflow](https://javascriptobfuscator.com/docs/npmcli.aspx): install, login, config file, plugins
- [Every protection option](https://javascriptobfuscator.com/docs/npmoptions.aspx): what each transform does and which plan it needs
- [Command line usage](https://javascriptobfuscator.com/docs/usecommandline.aspx)
- [Migrating from javascript-obfuscator or JS-Confuser](https://javascriptobfuscator.com/docs/npmmigration.aspx): one command converts an existing config
- [OpenAPI 3.1 contract](https://javascriptobfuscator.com/openapi.json) for the HTTP protection API

## Product

- [Online obfuscator](https://javascriptobfuscator.com/javascript-obfuscator.aspx): paste code, pick a preset, no account. The browser preview accepts about 32 KB of source per run; the CLI has no such limit.
- [Desktop app and downloads](https://javascriptobfuscator.com/downloads.aspx): Windows, with SHA-256 checksums and permanent versioned URLs for package managers
- [jso-protector CLI](https://javascriptobfuscator.com/jso-protector.aspx)
- [Pricing](https://javascriptobfuscator.com/premium-membership.aspx): free tier, then paid plans that raise the per-request size and unlock the stronger transforms

## Choosing between tools

- [Comparison against Jscrambler, JSDefender, obfuscator.io and JS-Confuser](https://javascriptobfuscator.com/compare-javascript-obfuscators.aspx)
- [Security and release evidence](https://javascriptobfuscator.com/security-evidence.aspx): signed release attestations, reproducible builds, source-map evidence

## Boundaries worth stating accurately

- **The hosted tool sends source to a server.** The online tool and the default
  CLI path submit code to javascriptobfuscator.com for processing. The desktop
  app's local modes and the CLI's `--local` flag protect on the machine instead;
  only VM bytecode protection still requires the hosted step.
- **Obfuscation is not encryption.** It raises the cost of reading and reusing
  shipped JavaScript. It does not make code unrecoverable, and anything the
  browser can run can be observed at runtime.
- **The Windows Forms build is not code-signed.** The WinUI 3 desktop app and
  its bundled CLI are Authenticode signed as `richscripts inc`; the legacy
  Windows Forms build was rebuilt after the signing certificate was retired and
  is not signed. Verify it with the published SHA-256 instead.

## Legal

- [Terms](https://javascriptobfuscator.com/terms.aspx) - proprietary, not open source, not redistributable
- [Privacy](https://javascriptobfuscator.com/privacy.aspx)