ObfuscateJS
ObfuscateJS documentation

Configure the obfuscator with confidence.

The obfuscator compiles supported standalone JavaScript into bytecode and returns a self-contained JavaScript artifact. Choose a preset, add optional protections, then execute the returned expression in the target runtime.

Open the workbench OpenAPI JSON

01 · Quick start

Generate an artifact

The API accepts one standalone-v1 JavaScript program. The response contains the artifact and the resolved protection metadata.

shell
curl -X POST https://obfuscatejs.com/api/obfuscate \
  -H 'content-type: application/json' \
  --data-raw '{
    "source": "function add(a,b){return a+b} add(2,3)",
    "seed": "demo",
    "options": { "strength": "high" }
  }'

02 · Presets

Choose a strength

Presets control the default feature flags. Explicit feature overrides can enable or disable individual protections.

none

Minimal generated VM; useful for debugging.

low

Runtime renaming, dispatch shuffling, and string encryption.

medium

Encoded bytecode, decoys, integrity entanglement, and numeric stack encoding.

high

Default preset with the stable protections enabled and anti-debug checks off.

paranoid

High plus sampled anti-debug checks and superinstructions.

03 · Request options

Build options

These options are nested under the request's options property. Omitted siteLock and errorValues settings keep the default behavior.

seed

Deterministic diversification seed. The API generates one when omitted.

timingHaltMs

Elapsed-time threshold for an enabled anti-debug guard.

antiDebugCheckInterval

Instructions between timing samples. Default: 32. Larger values reduce hot-path overhead.

hostSetup

JavaScript setup evaluated before VM startup. Use only for required host dependencies.

haltValue / tamperValue

Legacy aliases for timing and tamper failure values.

sourceFormat / syntaxProfile

Currently standalone and standalone-v1; imports, exports, JSX, and TypeScript are outside the contract.

04 · Site lock

Restrict where an artifact runs

Set exact hostnames under siteLock.domains. The artifact normalizes the browser hostname, derives a salted key, and compares that key with the generated allowlist. Domain strings are not embedded in the artifact.

Omit siteLock to run everywhere. Hostnames are exact: use each hostname explicitly for www and non-www variants. URL schemes, paths, and wildcard patterns are not accepted.
json
{
  "siteLock": {
    "domains": ["app.example.com", "app.example.org"]
  },
  "errorValues": {
    "tamper": { "result": "A17" },
    "timing": { "result": "B04" },
    "siteLock": { "result": "C09" }
  },
  "antiDebugCheckInterval": 32
}

05 · Opaque failures

Replace recognizable halt values

errorValues is a JSON object keyed by tamper, timing, and siteLock. Each value is returned verbatim for that situation, so you choose the property names and messages. Paste the complete object; the workbench includes Use example and Copy example buttons.

tamper

Returned when the generated function's integrity check fails.

timing

Returned when a sampled anti-debug timing check exceeds timingHaltMs.

siteLock

Returned when the current hostname does not produce an allowed key.

The API response exposes the resolved values and derived site keys under protection so build tooling can record the configuration.

06 · Feature overrides

Tune individual protections

All of these boolean flags are available under options.obfuscation. Disable expensive features for hot code or enable only the transformations your artifact needs.

Runtime structure

  • renameRuntime
    Rename generated runtime bindings.
  • shuffleDispatch
    Shuffle instruction dispatch cases.
  • mixedInstructionShapes
    Use multiple instruction record shapes.
  • semanticHandlers
    Vary handler expression structure.
  • superInstructions
    Fuse selected instruction pairs.

Data and bytecode

  • encryptStrings
    Encode string constants and host setup text.
  • encodeBytecode
    Encode bytecode chunks until they are materialized.
  • splitHolders
    Distribute constants and bytecode across holders.
  • encodeStackNumbers / encodeStackObjects
    Wrap stack values; stronger but costly on the VM hot path.
  • mutateInstructionEncoding
    Use per-chunk instruction masks.

Noise and integrity

  • opaquePredicates
    Add predicates whose result is known at build time.
  • deadCode
    Emit unreachable runtime branches.
  • decoyHandlers / decoyBytecode
    Add unused handlers and tape noise.
  • capturePrimitives
    Capture selected built-in methods.
  • entangleIntegrity
    Tie encoded bytecode checks to runtime state.

07 · Artifact execution

Execute the API response

The API returns a self-contained JavaScript expression in artifact. Evaluate that expression in the target runtime; the generated program then runs its virtualized bytecode.

Browser code can always be inspected by a determined attacker. Obfuscation raises reverse-engineering cost; it does not protect secrets.
javascript
const response = await fetch('/api/obfuscate', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    source: 'function add(a,b){return a+b} add(2,3)',
    seed: 'demo',
    options: { strength: 'high' },
  }),
})
const { artifact } = await response.json()
const result = await new Function(`return ${artifact}`)()