Rename, encode, flatten — the real obfuscator engine, running locally in your browser
| Transform | What it does | Size on 191-byte sample | Runtime cost |
|---|---|---|---|
| Compact + renaming | Hex identifiers, one line | 1,325 B (6.9×) | None |
| Unicode escapes | Escapes string characters as \uXXXX | 1,852 B (9.7×) | None (parsed once) |
| String array, base64 | Strings pulled into an encoded array behind a decoder | 2,454 B (12.8×) | Trivial |
| + control-flow flattening | Linear logic becomes a switch state machine | 2,922 B (15.3×) | Real — avoid in hot loops |
| String array, RC4 | Decoder adds an RC4 layer per access | 3,970 B (20.8×) | Noticeable at scale |
| Dead-code injection | Pads branches with unreachable code | grows with threshold | Parse-time only |
Sizes from this engine on the sample in the tool; exact bytes vary a little per run because generated identifiers are random. Every variant was executed after transformation and returned the original output — obfuscation must never change behavior, only legibility.
This is javascript-obfuscator 5.6.0 (BSD-2-Clause), the engine behind most "obfuscator.io"-style services, shipped as its official browser build (1.7 MB, loaded on first run) and executed in your tab. Your options map straight to the engine's transform pipeline — nothing is emulated or approximated.
The sample holds a 191-byte license-key function — two string constants, one numeric salt, string concatenation — that prints TA-PRO-STU-84. Running it through three escalating configurations:
TA-PRO and stuart still sit in plain sight.TA-PRO and you find nothing.After every level, executing the output still prints exactly TA-PRO-STU-84 — verified in a sandbox before shipping this page. That's the contract of obfuscation: same behavior, hostile readability.
Obfuscation by javascript-obfuscator 5.6.0 (BSD-2-Clause, © Timofei Kachalov), vendored as the official browser build under /vendor/ with its license. Everything runs in your browser tab.
It transforms readable source into functionally identical code that's expensive to reverse: identifiers become hex names, strings move into an encoded array fetched through a decoder function, control flow gets flattened into switch-based loops, and dead branches pad the logic. The output runs exactly like the input — a license-key function that prints TA-PRO-STU-84 prints it after every transform level — it just stops being worth anyone's time to read.
Yes, always — the browser must be able to run it, so a determined attacker with time can recover the logic. Obfuscation raises cost, it doesn't create impossibility. Pair it with real protections: keep secrets and license checks server-side, use code signing and legal protection for IP, and treat obfuscation as the speed bump that makes casual scraping not worth it.
A lot. Measured on a 191-byte test function: compact-only renaming grows it 6.9x to 1,325 bytes; adding base64 string-array encoding reaches 12.8x (2,454 bytes); RC4 encoding 20.8x (3,970); control-flow flattening on top lands at 15.3x (2,922). Size inflation is the tax — budgets of 2-5x are common for shipped bundles, and the high presets assume you'll also ship a minifier pass.
Some transforms do. Control-flow flattening rewrites linear logic into a loop with a state machine, which costs on every hot-path call; dead-code injection inflates parse time; RC4 string decoding adds work at each string access. Measure: flatten the functions that hold your logic, not the ones in your render loop. The string-array and renaming transforms are close to free at runtime.
No. The full obfuscator engine ships with this page (about 1.7 MB, loaded on first run) and every transform runs in your browser tab. Your source never touches a server — which matters, since the code people want to obfuscate usually contains exactly the logic they least want to share.
Minification (Terser, esbuild) makes code smaller — short names and stripped whitespace, but the structure and strings remain plainly readable. Obfuscation makes code harder to understand — encoded strings, flattened control flow, injected dead branches — and usually makes it bigger. They compose: minify first for production size, obfuscate the sensitive parts, or obfuscate then minify the result. Never confuse minification with protection; it's a speed bump you can read.