ObfuscateJS
JavaScript VM obfuscator

Obfuscate JavaScript with VM-based transformations.

Make browser JavaScript harder to read, copy, and tamper with by transforming it into bytecode executed by a generated virtual machine.

Try the obfuscator View API
Artifact excerpt
(()=>{const np=s=>{let h=2166136261;for(let i=0;i<s.length;i++){h^=s.charCodeAt(i);h=Math.imul(h,16777619)}return h>>>0},yh=async()=>{
const pd=Array.isArray.bind(Array),KN=JSON.parse.bind(JSON),Qn=String.fromCharCode.bind(String);
const EA=[],aX=v=>typeof v==='number'?{"aR":698280330,"Xf":v}:v;
const ZV=[[{"Xa":2,"eq":[253]},0],[{"Xa":2,"eq":[256,286,261]},0]];
const u$={"cO":[27,197,113,101,210,31,139,...],"Sb":[200,252,26,196,37,...]};
const HE=13,sj=[[u$,"cO"],[u$,"Sb"]],mu={},Wy=[54623,8242,33810];
const Jt=(h,k,n)=>{let e=h[k],x=(1108000497^n*2654435761)>>>0,a=[];/* decode */return KN(Qn(...a))};
let s=[{}],k=[],j=[],p=0,z=[];const q=()=>{let v=z[z.length-1];z.length--;return v};
while(p<HE){const e=sj[p/6|0],i=(mu[p/6|0]||(mu[p/6|0]=Jt(e[0],e[1],p/6|0)))[p++%6],r=[i[2]^Wy[(p-1)/6|0],i[3]];
switch(r[0]){case 34570:z.push(aX(ZV[r[1]]));break;case 46143:{let a=q(),b=q();z.push(aX(b+a));break}default:throw Error('Unsupported instruction')}}
return z[z.length-1]};if(np(yh.toString())!==2782255079)return Promise.resolve({"result":"A17"});return yh()})()
Live obfuscator

Paste JavaScript, get an artifact

Configuration

Preset + optional feature overrides
Custom failure values optional JSON
Optional JSON returned for tamper, timing, or site-lock failures. Read the docs for the format.

Source

46 chars

Obfuscated artifact

Not generated yet

API result

same-origin POST /api/obfuscate
API result will appear here...

VM-based obfuscation

Source is compiled to bytecode and emitted with a JavaScript VM runtime.

Aggressiveness

More aggressive transformations make the output harder to inspect, but slower to run.

API access

The same obfuscation flow is available through /api/obfuscate.

Use the API

Send source code and options to generate an obfuscated artifact. The API accepts the same aggressiveness and feature controls as the UI. Read the obfuscator docs or see the full request and response schemas in the OpenAPI spec.

curl -X POST https://obfuscatejs.com/api/obfuscate \
  -H 'content-type: application/json' \
  --data-raw '{
    "source": "function add(a,b){return a+b} add(2,3)",
    "seed": "demo",
    "options": { "strength": "high" }
  }'

Obfuscation, briefly

A quick overview before deciding what to protect and how aggressive to be.

Disclaimer: ObfuscateJS is a recent project and is not production-ready yet. If you hit a bug or need support for more JavaScript operations or syntax, DM me on X.

What is JavaScript obfuscation?

Obfuscation transforms readable source code into code that behaves the same way but is harder to understand, rename, debug, or copy.

What does VM-based obfuscation mean?

Instead of shipping your original logic directly, ObfuscateJS compiles supported JavaScript into bytecode and emits a small virtual machine that runs it in the browser.

Does obfuscation make code impossible to reverse engineer?

No. Browser code is always inspectable by a determined attacker. Obfuscation raises the cost and slows down casual copying, patching, and static analysis.

What should I obfuscate?

Use it for client-side logic you want to make less readable. Do not put real secrets such as API private keys in browser JavaScript.