JS Obfuscator

How to Use

JavaScript Obfuscator — protect your source code directly in the browser.

Getting Started

1. Paste or Upload

Paste your JavaScript code into the Input panel, or click Upload to load a .js / .ts / .mjs / .cjs file. You can also drag and drop a file directly onto the input area.

2. Choose Options

Toggle the protection features and select a target environment. See the feature reference below for details on each option.

3. Obfuscate

Click OBFUSCATE → or press Ctrl+Enter. The obfuscated output appears in the right panel instantly.

4. Copy or Download

Use the Copy button to copy the output to clipboard, or Download to save it as a .obfuscated.js file.

Feature Reference

Rename Variables

Replaces all variable, function, and parameter names with short unreadable identifiers. Available in both full and lite engine.

String Array full only

Extracts all string literals into a hidden array and replaces them with encoded lookup calls. Makes strings invisible in the output.

Dead Code Injection full only

Injects random blocks of fake code that never execute, making it harder to follow the real program flow.

⚠ Can increase output size by up to 200%.

Control Flow Flattening full only

Restructures the control flow of every function into a flat dispatcher loop, hiding the original logical order of operations.

⚠ Can slow runtime performance by up to 1.5×.

Self Defending full only

Makes the obfuscated code resistant to beautifiers and formatters. If the output is reformatted, the code will stop working.

Debug Protection full only

Makes it nearly impossible to use browser DevTools debugger on the obfuscated code by continuously forcing debug mode.

⚠ May freeze the browser tab if DevTools is open.

Drop Console

Disables all console.* calls in the output by replacing them with empty functions, preventing runtime logging.

Drop Debugger

Removes all debugger; statements from the output code.

Numbers to Expressions full only

Converts numeric literals into complex arithmetic expressions that evaluate to the same value, obscuring constants.

Split Strings full only

Splits string literals into smaller chunks joined at runtime, making strings harder to search for in the output.

Target Environment

Browser

Standard web page environment. Default option — suitable for most browser-based JavaScript.

Browser (no eval)

Same as Browser but avoids eval(). Use this when the page enforces a strict Content Security Policy (CSP).

Node.js

Server-side Node.js environment. Disables browser-specific protections that rely on window or document.

Service Worker

Service Worker context. No window or document — uses the self global instead.

Userscript

Userscript manager sandbox (e.g. Tampermonkey / Greasemonkey). Defenses are adjusted for the userscript execution environment.

Bytenode

Prepares output for compilation with bytenode into V8 cached bytecode (.jsc). Run bytenode on the output yourself after obfuscation.

Engine Fallback

Full Engine

Uses javascript-obfuscator — the primary engine with all features available. Loaded from CDN on startup.

Lite Engine

Falls back to Terser if the primary CDN fails to load. Only Rename Variables, Drop Console, and Drop Debugger are available in this mode. A warning will appear if you try to use unsupported features.

🔒

Your code is never uploaded or stored. All obfuscation runs entirely inside your browser using third-party open-source libraries (javascript-obfuscator and Terser) loaded from jsDelivr CDN.

🌐

This tool makes no server requests with your code. The only network activity is loading the obfuscator library from CDN on first use.

📦

Third-party libraries used: javascript-obfuscator (primary engine) and Terser (fallback engine). Both are open-source and can be audited independently.

🚫

We do not collect analytics, cookies, or any personally identifiable information.