Correctness · New
2026-08-02
~7 min read
Does obfuscation preserve “use strict”?
String tables and wrappers can quietly demote a directive prologue. Here is what changes when strict mode is lost and a small runtime probe that verifies the protected result.
Read article ›
Engineering · New
2026-08-02
~6 min read
Obfuscating ES modules: what changes without a bundler
Export names are a public contract, not safe rename targets. Learn what remains protectable behind that module boundary and how to verify that protected .mjs files still link.
Read article ›
Fundamentals · New
2026-07-27
~8 min read
JavaScript obfuscation techniques explained
Obfuscation is not one thing — it is a stack of transforms with different costs. Identifier renaming, string arrays, encoding and encryption, cross-file member renaming, control-flow flattening, and bytecode virtualization: what each removes, what it costs at runtime, and where to apply it.
Read article ›
Troubleshooting · New
2026-07-27
~7 min read
Obfuscated JavaScript not working? The six causes, in order
It ran before protection and breaks after it. Nearly always one of six things — and the first one, a name matched as a string at runtime, accounts for most of them. How to find which, bisect the transforms, and build a repro worth sending.
Read article ›
Operations · New
2026-07-27
~6 min read
How to debug obfuscated JavaScript in production
Don’t ship the source map. Keep each build’s identifier map private, translate field stack traces locally with jso-symbolicate, and run captured Sentry or Datadog events through the matching adapter — no upload, no key in the browser.
Read article ›
Source handling · New
2026-07-27
~6 min read
Is it safe to use an online JavaScript obfuscator?
A textarea is not a sandbox — pasting is uploading. The ten-second Network-tab test that settles it for any vendor, the questions a security reviewer will ask you, and when to move to CI or a local workflow instead.
Read article ›
Design guidance · New
2026-07-27
~7 min read
How to protect a JavaScript licence or trial check
One boolean stands between your paid product and a free one. Move authority to the server, virtualize the validation path, stop concentrating the decision in a single flag, and instrument tampering so a bypass surfaces in a week rather than never.
Read article ›
Legal & Licensing · New
2026-07-21
~5 min read
Is JavaScript obfuscation legal?
Yes — obfuscating code you own or are licensed to modify is legal and routine. The real constraints aren’t obfuscation itself: honor third-party and copyleft (GPL) license terms, respect publishing rules (browser-extension stores forbid it), and remember obfuscation never launders illegal behavior.
Read article ›
Fundamentals · New
2026-07-21
~5 min read
Obfuscation vs encryption: what’s the difference?
Not the same thing. Encryption needs a key to run and is reversible with it; obfuscation runs directly and only raises the cost of understanding. Anything that “encrypts” client-side JavaScript must ship the key to the browser — so it’s really obfuscation with extra steps.
Read article ›
Deployment hygiene · New
2026-07-21
~6 min read
Why does obfuscated JavaScript trigger antivirus false positives?
Because malware pioneered the same techniques — string arrays, eval loaders, packed blobs — so heuristics fire on the shape, not the intent. How to ship protected code that doesn’t get quarantined: avoid eval, serve external files, sign your builds, keep behavior transparent.
Read article ›
SEO · New
2026-07-19
~5 min read
Does obfuscating JavaScript hurt your SEO?
No — Google indexes the rendered page, not your source, so behavior-preserving obfuscation is SEO-neutral. The real rules: keep JSON-LD structured data readable (it’s data, not code), don’t bloat the bundle (Core Web Vitals), don’t block your JS from crawlers, and verify the rendered DOM is unchanged.
Read article ›
Security engineering · New
2026-07-19
~5 min read
Does obfuscation break Content Security Policy?
Old eval-based packers break strict CSP; modern obfuscation doesn’t. String decoding, control-flow flattening, and VM bytecode are ordinary code — no eval, no new Function — so protected output runs under a strict CSP without unsafe-eval. Serve it as an external file and keep your policy strict.
Read article ›