Migrate in one command

Moving off obfuscator.io? Bring your config, don’t rewrite it.

The open-source javascript-obfuscator package is a capable free tool. If you have outgrown it — you need VM bytecode protection, runtime defense, on-device protection with support, or a signed release attestation — you can convert your existing config with a single command and keep your build exactly as it is.

Try Online Free Migration Docs Full Comparison
Convert your existing config

One command, no rewrite.

jso-protector --migrate-javascript-obfuscator \
  javascript-obfuscator.json --output jso.config.json

Direct options convert as-is; approximate ones convert with a review note. Try protection first with no account at all:

npx javascriptobfuscator-com app.js
Be Honest First

Should you even move off the free package?

Often not — and we would rather tell you that than sell you something you do not need. The open-source javascript-obfuscator package runs on your machine, costs nothing, and handles identifier renaming, string protection, control-flow flattening and dead-code insertion well. Move only for a capability it does not have.

Stay on the free package if…

  • Identifier, string and control-flow obfuscation is enough for your threat model.
  • You need protection to run entirely locally for free, with no per-request limits.
  • You have no high-value function that justifies a heavier protection layer.
  • You do not need a vendor to answer for breakage or provide audit evidence.

Move to JavaScript Obfuscator when…

  • A few functions (licensing, key derivation, anti-tamper) justify VM bytecode protection.
  • You want runtime defense — anti-tamper, anti-debug, anti-agent detection.
  • You cannot ship source to a third party and need on-device protection of modern code.
  • An auditor needs a signed, reproducible release attestation.
  • You want a support relationship when protection meets a real build.
The Migration

Your config comes with you

The CLI reads your existing javascript-obfuscator config and writes a JavaScript Obfuscator one. You do not relearn an option surface or rewrite a build.

What you do today After migrating
A javascript-obfuscator.json / .cjs config jso-protector --migrate-javascript-obfuscator converts it to jso.config.json; direct options as-is, approximate ones flagged.
A webpack / vite / rollup / esbuild plugin Drop-in bundler wrappers, or the CLI as a final build step on your output directory. See migration docs.
A seed for repeatable output Same idea: --seed gives byte-identical builds; omit it for per-build polymorphism.
Everything runs locally and free Try with no account (npx javascriptobfuscator-com); a free key gives 200 KB / 20 files per request. Only VM bytecode always runs hosted.
Migration Guide Option Reference Hosted vs npm Package
Compare Before You Commit

Protect one file both ways and diff the output.

The most honest migration test is your own code. Protect a representative file with your current tool and with npx javascriptobfuscator-com, run both, and compare. No account, no install, no commitment.

Test Protection View Plans Full Comparison
Common Questions

Migrating off obfuscator.io, answered plainly

Including the questions where the honest answer is “stay where you are.”

Do I have to rewrite my javascript-obfuscator config?

No. jso-protector --migrate-javascript-obfuscator reads your existing JSON or CommonJS config and writes a jso.config.json. Direct options convert as-is; approximate ones convert with a review note. You keep your build; only the protection step changes.

Should I even move off the free package?

Often not, and we will say so. The open-source javascript-obfuscator package runs on your machine for free and is a genuinely capable tool. Move when you need VM bytecode protection for a few high-value functions, runtime defense, on-device protection of modern source with support, or a signed release attestation. If none of those apply, stay put.

Can I try it without an account?

Yes. npx javascriptobfuscator-com app.js protects a file with no account and no install step, so you can compare output against your current tool before changing anything. A free account raises the per-request limit to 200 KB and 20 files.

Does my source leave my machine?

Be precise, because it is the honest trade. The default hosted path sends selected JavaScript to the service. Desktop Local Advanced and the jso-local CLI protect modern source on-device with only a source-free entitlement check; VM bytecode protection is the one step that always runs on the server. The free package always runs locally.