JavaScript Obfuscator
Paste JavaScript and turn it into code that still runs the same but is hard to read and reuse. Pick a low, medium or high preset or fine-tune every option, then check that both versions print the same output before you ship.
Last updated:
Options
How to use the JavaScript Obfuscator
- Paste your JavaScript or open a .js file. A sample is loaded so you can see the result right away.
- Choose a preset. Low is fast and small, Medium is a balanced default, High is strongest but much larger and slower.
- Adjust options if needed, for example keep public function names under Keep these names.
- Press Obfuscate JavaScript and check the size change in the status bar.
- Press Run both & compare output to confirm the obfuscated code behaves the same, then copy or download it.
What each option does
| Option | Effect | Cost |
|---|---|---|
| Rename identifiers | total becomes _0x3f2a1c (or a). Local names only, unless global renaming is on. | None; may even shrink code |
| String array | String literals move into one array and are read through a lookup function: 'SAVE25' becomes _0x5d1e(0x1a3). | Small |
| Base64 / RC4 encoding | Strings in the array are stored encoded, so they cannot be found by searching the file. | RC4 is slower to decode |
| Rotate / shuffle | The array is stored in a scrambled order and restored at start-up. | Tiny |
| Split strings | Long strings are cut into chunks joined with +. | Larger output |
| Control-flow flattening | Blocks of statements are put in a switch inside a loop that runs them in a hidden order. | Up to ~1.5× slower, larger |
| Dead code injection | Adds realistic-looking code that never runs. | Much larger output |
| Numbers to expressions | 100 becomes something like -0x1*0x9e5+0x2a3*0x3+... | Small |
| Transform object keys | Object literal keys are assigned one by one through the string array. | Small |
| Self-defending | The code checks its own formatting and stops working if it is beautified. | Breaks if you reformat it later |
| Disable console output | Replaces console.log, warn, error and similar with empty functions. | Hides your own logs too |
Tips for obfuscating safely
- Obfuscate the build output, not your source files. Keep the readable original in version control and generate the obfuscated file as a build step.
- Protect public names. Functions called from HTML (
onclick="init()"), from other scripts or by a framework must keep their names: list them under Keep these names and leave global renaming off. - Use strong settings selectively. High presets on a large library can multiply its size and slow it down. Obfuscate only the part worth protecting, such as a scoring algorithm or a custom renderer.
- Test the result. Run both versions with Run both & compare output, then test the obfuscated file in its real page, especially code that touches the DOM.
- Do not rely on it for secrets. Obfuscation is a speed bump, not encryption. API keys, credentials and validation that must be trusted belong on a server.
Obfuscation, minification and beautifying
These three are often confused. A minifier makes code as small as possible for faster loading and incidentally makes it harder to read. A beautifier does the reverse, restoring indentation and line breaks, which is why obfuscators go further than minifiers: after beautifying, minified code is readable again, while obfuscated code still has meaningless names, encoded strings and scrambled control flow. If file size is your only goal, use a minifier; reach for obfuscation when you want to discourage copying or tampering.
Frequently asked questions
What does a JavaScript obfuscator do?
It rewrites your code so it behaves the same but is very hard for people to read: variable and function names become meaningless, strings are moved into an encoded array, and the order of the code can be scrambled with control-flow flattening and fake dead code. Browsers run it like any other script.
Is obfuscated JavaScript secure?
No. Obfuscation slows down and discourages copying and tampering, but any code that runs in a browser can eventually be analysed. Never put secrets such as API keys, passwords or licence checks that must be unbreakable in client-side JavaScript; keep them on a server.
Will obfuscation slow down my code?
It can. Low settings have little effect. Control-flow flattening, dead code injection and RC4 string encoding add work at run time and can make output several times larger, so use them for small sensitive parts rather than whole frameworks, and test performance.
Why did my code stop working after obfuscation?
The usual causes are renaming globals that other scripts or HTML attributes such as onclick call by name, code that relies on function.name or eval, and self-defending code that was reformatted afterwards. Add the names to Keep these names, turn off Rename global variables or Self-defending, and use the compare button to check.
What is the difference between minifying and obfuscating?
Minifying removes whitespace and shortens names to make files smaller and faster to load. Obfuscating deliberately makes code harder to understand, usually making it larger. Minify everything you ship; obfuscate only code you want to protect.
Can obfuscated code be reversed?
Partly. Formatting tools restore indentation, and deobfuscators can decode string arrays, but the original names and comments are gone for good and flattened control flow takes real effort to untangle. Stronger settings raise that effort.
Is my code uploaded?
No. The obfuscator library runs in your browser and your code is never sent to a server. The compare feature also runs locally, in an isolated web worker.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.