JavaScript obfuscator

---

🚀 Obfuscator.io with VM Obfuscation

Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse engineering and automated deobfuscation dramatically harder.

Protection goal	Free (this package)	obfuscator.io
Rename identifiers	✅ variable/function renaming	✅ + VM-local symbols never exposed as JavaScript
Obscure strings	✅ string array + base64/rc4	✅ + strings embedded in bytecode constants
Obscure control flow	✅ control flow flattening	✅ full bytecode virtualization, vmJumpsEncoding (runtime-computed jump targets), vmDeadCodeInjection (fake bytecode sequences)
Resist decompilation	⚠️ output is still JavaScript	✅ custom opcodes, vmStatefulOpcodes (position-dependent opcode mapping), vmMacroOps (fused instructions), vmDecoyOpcodes (fake opcode handlers)
Resist automated LLM-based analysis	❌ fully vulnerable (no LLM-specific defenses)	✅ bytecode encryption + anti-LLM defenses in vmSelfDefending and vmDebugProtection
Encryption	✅ stringArrayEncoding (base64/rc4 on extracted strings)	✅ vmBytecodeEncoding (per-instruction encoding), vmBytecodeArrayEncoding (whole bytecode array as single block)
Anti-debugging	✅ debugProtection (freezes browser DevTools)	✅ vmDebugProtection (multi-layered anti-debugging and anti-analysis defenses)
Tamper detection	✅ selfDefending (breaks if beautified)	✅ vmSelfDefending (multi-layered tamper detection, anti-hooking, anti-reverse-engineering protection)
Runs offline, no network	✅	❌ uses obfuscator.io API (requires token)

Visit Obfuscator.io · Pro API methods

This package provides access to Obfuscator.io API via CLI and Node.js API.

---

Do you use JavaScript Obfuscator at your company?

JavaScript Obfuscator has reached over 1 million npm downloads per week. I am currently preparing an EB-1 immigration case and collecting independent evidence of the project’s real-world professional usage and impact.

If you use JavaScript Obfuscator in a company project — especially at a well-known company, large organization, or widely used product — I would be very grateful if you could contact me.

Helpful evidence may include a brief confirmation or, ideally, a 1–2 page reference letter describing:

• how your team or company used JavaScript Obfuscator;
• why you chose it;
• what problem it helped solve;
• whether it was used in production or an important internal workflow;
• your role and how you are familiar with the usage.

I can provide a simple draft/template to make this easy.

Please contact me at: [email protected]

Thank you for supporting the project.

---

JavaScript Obfuscator is a powerful free obfuscator for JavaScript, containing a variety of features which provide protection for your source code.

Key features:

• VM bytecode obfuscation (via Obfuscator.io)
• variables renaming
• strings extraction and encryption
• dead code injection
• control flow flattening
• various code transformations
• and more...

The example of obfuscated code: github.com

Online version:

obfuscator.io

Plugins:

• Webpack plugin: webpack-obfuscator
• Webpack loader: obfuscator-loader
• Esbuild plugin: esbuild-javascript-obfuscator
• Gulp: gulp-javascript-obfuscator
• Grunt: grunt-contrib-obfuscator
• Rollup: rollup-plugin-javascript-obfuscator
• Weex: weex-devtool
• Malta: malta-js-obfuscator
• Netlify plugin: netlify-plugin-js-obfuscator
• Snowpack plugin: snowpack-javascript-obfuscator
• Vite plugin: vite-plugin-bundle-obfuscator