JavaScript Obfuscator Free Online Tool 2026

Last updated March 22, 2026

Example: String Encryption

// Original:
const API_ENDPOINT = 'https://api.example.com/v2';
const SECRET_HEADER = 'X-Api-Key';

function callApi(data) {
  return fetch(API_ENDPOINT, {
    headers: { [SECRET_HEADER]: getKey() }
  });
}

// After string encryption:
var _0x3f2a = function(_0x1b2c) {
  var _0x4d5e = 'aHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20vdjI=';
  return atob(_0x4d5e.split('').reverse().join(''))[_0x1b2c];
};

function callApi(_0x6a7b) {
  return fetch(_0x3f2a(0), {
    headers: { [_0x3f2a(1)]: getKey() }
  });
}

Example: Control Flow Flattening

// Original:
function processPayment(amount, method) {
  if (method === 'card') {
    chargeCard(amount);
  } else if (method === 'paypal') {
    chargePaypal(amount);
  } else {
    throw new Error('Unknown method');
  }
}

// After control flow flattening:
function processPayment(_0x1a2b, _0x3c4d) {
  var _0x5e6f = '2|0|1|3'.split('|');
  var _0x7a8b = 0;
  while (true) {
    switch (_0x5e6f[_0x7a8b++]) {
      case '0':
        chargeCard(_0x1a2b);
        continue;
      case '1':
        chargePaypal(_0x1a2b);
        continue;
      case '2':
        if (_0x3c4d === 'card') { _0x5e6f = '0|3'.split('|'); _0x7a8b = 0; continue; }
        if (_0x3c4d === 'paypal') { _0x5e6f = '1|3'.split('|'); _0x7a8b = 0; continue; }
        continue;
      case '3':
        throw new Error('\x55\x6e\x6b\x6e\x6f\x77\x6e\x20\x6d\x65\x74\x68\x6f\x64');
    }
    break;
  }
}

Example: Dead Code Injection

// Original:
function getScore(player) {
  return player.points * player.multiplier;
}

// After dead code injection:
function getScore(_0x1a2b) {
  var _fake1 = function() {
    if (Math.random() > 9999) {
      return '\x6e\x65\x76\x65\x72';
    }
  };
  var _fake2 = _fake1() || null;
  if (_fake2 === '\x6e\x65\x76\x65\x72') {
    _fake1();
    return -1;
  }
  return _0x1a2b['\x70\x6f\x69\x6e\x74\x73'] * _0x1a2b['\x6d\x75\x6c\x74\x69\x70\x6c\x69\x65\x72'];
}

Obfuscation Strength Levels

Original code size: 2.4 KB

Light obfuscation:
  Techniques: variable renaming, string encoding
  Output size: 3.1 KB (+29%)
  Execution overhead: ~0%
  Reverse engineering difficulty: Low-Medium

Medium obfuscation:
  Techniques: + control flow flattening, dead code injection
  Output size: 5.8 KB (+142%)
  Execution overhead: ~2%
  Reverse engineering difficulty: Medium-High

Heavy obfuscation:
  Techniques: + string encryption, self-defending code
  Output size: 12.4 KB (+417%)
  Execution overhead: ~5%
  Reverse engineering difficulty: High

Example: Domain Locking

// Original code with domain lock applied to example.com:

// The obfuscator injects a domain check:
(function() {
  var _0x1a2b = window.location.hostname;
  var _0x3c4d = ['\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63\x6f\x6d'];  // 'example.com'
  if (_0x3c4d.indexOf(_0x1a2b) === -1) {
    // Domain not authorized — disable functionality
    Object.freeze(window);
    throw new Error();
  }
})();

// Your actual code follows...
// It only runs on example.com

Example: Self-Defending Code

// Self-defending obfuscated code detects tampering:

// If someone tries to beautify/format the code, this check fails:
(function(_0x1a2b, _0x3c4d) {
  var _check = function(_0x5e6f) {
    while (--_0x5e6f) {
      _0x1a2b['push'](_0x1a2b['shift']());
    }
  };
  // The rotation count is verified against a checksum
  // Formatting the code changes whitespace, breaking the checksum
  _check(++_0x3c4d);
}(_0x4a5b, 0x1b3));

Before/After Size Comparison

File: game-engine.js

Original:           45,200 bytes  (44 KB)
After minification: 22,100 bytes  (22 KB)
After obfuscation:  38,400 bytes  (38 KB)
Min + obfuscate:    31,200 bytes  (30 KB)

Gzip (original):    12,800 bytes  (13 KB)
Gzip (obfuscated):  14,200 bytes  (14 KB)

Note: Obfuscation slightly reduces gzip efficiency due to
randomized variable names that compress less well than
meaningful English words.

Important Limitations

• Obfuscation is not encryption — a determined attacker can still reverse-engineer it
• Browser DevTools can set breakpoints and inspect runtime values regardless of obfuscation
• Sensitive operations (auth, crypto keys) should always be server-side, not client-side
• Source maps must not be publicly accessible when using obfuscation
• Open source projects should not use obfuscation — source is already public
• Heavy obfuscation increases file size and may slightly impact performance

Use the obfuscator to protect proprietary algorithms and intellectual property in client-side JavaScript. Choose the obfuscation level that balances protection with acceptable file size and performance impact.

// Original code:
function validateLicenseKey(key) {
  const validKeys = ['ABC-123', 'XYZ-456', 'DEF-789'];
  return validKeys.includes(key);
}

// After obfuscation (light):
var _0x4a2b=['ABC-123','XYZ-456','DEF-789','includes'];
function validateLicenseKey(_0x1c3d){
  var _0x5e6f=[_0x4a2b[0],_0x4a2b[1],_0x4a2b[2]];
  return _0x5e6f[_0x4a2b[3]](_0x1c3d);
}