Encrypt JavaScript

Encrypt JavaScript code online, and what that can really mean

Q: What is the difference between encoding and encrypting strings?

Encoding respells each character as an escape such as \x41, which any beautifier turns back into text. Encryption stores the strings scrambled with a key and rebuilds them at run time through generated code, so they cannot be read without running or tracing that code.

People search for a way to encrypt JavaScript so nobody can read it. The browser has to run your code, so whatever unlocks it must ship with it. What you can do is make the code and its strings slow and tedious to read. Below, the three levels of string protection applied to the same function, with the real output of each.

Encrypt Your Code Online See the Three Levels

The Short Answer

Obfuscation, not secrecy

“JavaScript encryption” tools rename, encode, encrypt strings and pack code. All of it unpacks in the browser. That raises the cost of copying and tampering; it does not hide a password or an API key.

FreeEncode and move strings, rename

EnterpriseEncrypt Strings

Try firstEvery option previews free online

The Sample

One function with strings worth hiding

An API path, a client header and an error message. All four outputs below came from our engine and were formatted for reading; each one made the same request and returned the same result as the original when run.

report.js

function loadReport(userId) {
  var endpoint = "/api/v2/reports/" + userId;
  var headers = { "X-Client": "dashboard-web" };
  return fetch(endpoint, { headers: headers }).then(function (res) {
    if (!res.ok) throw new Error("Report service unavailable");
    return res.json();
  });
}

Level 1 · Free

Encode Strings: the text is no longer searchable

Every character becomes an escape sequence. Searching the file for reports or unavailable finds nothing — but a beautifier or the browser console turns the escapes back into text instantly.

Encode Strings

var endpoint="\x2F\x61\x70\x69\x2F\x76\x32\x2F\x72\x65\x70\x6F\x72\x74\x73\x2F"+ userId;
var headers={"\x58\x2D\x43\x6C\x69\x65\x6E\x74":"\x64\x61\x73\x68\x62\x6F\x61\x72\x64\x2D\x77\x65\x62"};
...
throw  new Error("\x52\x65\x70\x6F\x72\x74\x20\x73\x65\x72\x76\x69\x63\x65\x20\x75\x6E\x61\x76\x61\x69\x6C\x61\x62\x6C\x65")

Level 2 · Free

Move Strings: text and meaning come apart

Strings are lifted into one table at the top of the file, and each use becomes an index into it. With variable renaming on, nothing at the use site says what the value is.

Replace Names + Move Strings + Encode Strings

var _$_2476=["\x2F\x61\x70\x69\x2F\x76\x32\x2F\x72\x65\x70\x6F\x72\x74\x73\x2F","\x64\x61\x73\x68\x62\x6F\x61\x72\x64\x2D\x77\x65\x62","\x52\x65\x70\x6F\x72\x74\x20..."];
function loadReport(c)
{
	var a=_$_2476[0x0]+ c;
	var b={"\x58\x2D\x43\x6C\x69\x65\x6E\x74":_$_2476[0x1]};
	return fetch(a,{headers:b}).then(function(d)
	...
			throw  new Error(_$_2476[0x2])

Level 3 · Enterprise

Encrypt Strings: the table itself is scrambled

The string table is stored as one shuffled blob plus a key, and generated code rebuilds it when the script starts. No beautifier recovers the text; someone has to run or trace the decoder. Note what that means, though: the decoder and its key are in the same file, because the browser needs them.

Replace Names + Move Strings + Encode Strings + Encrypt Strings

var _$_2476=(function(n,r)
{
	var x=n.length;
	var s=[];
	for(var j=0;j< x;j++)
	{
		s[j]= n.charAt(j)
	}
	;
	for(var j=0;j< x;j++)
	{
		var t=r* (j+ 496)+ (r% 33940);
		var d=r* (j+ 656)+ (r% 33604);
	...
}
)("iphar/2abpaontsRcdp relv eb/useeaoertvisr/aa%r-oevdbi%wl/",5638772);
function loadReport(A)
{
	var y=_$_2476[0x0]+ A;
	...

Encrypt Strings works on the string table, so it needs Move Strings: switched on alone, it left this sample unchanged. The online tool turns the prerequisite on for you.

Side By Side

What each technique costs someone reading your code

Technique	What a reader sees	How it is undone	Plan
Encode Strings	Escape sequences instead of text	Instantly, by any beautifier	Free
Move Strings	Indexes into a table	Resolving each index by hand or script	Free
Replace Names	Meaningless local names	Not undone: original names are gone	Free
Encrypt Strings	A scrambled blob and a decoder	Running or tracing the decoder	Enterprise
Compressor (packing)	A self-extracting wrapper	A breakpoint where it unpacks	Basic

Packing the whole file — what many “encrypt JavaScript” sites do with eval(atob(...)) — looks the most encrypted and is the quickest to undo, because the unpacked code appears in memory in one piece. It also needs a Content-Security-Policy that allows eval. The strongest results come from combining transforms; see each transform on real code and VM bytecode protection, which replaces your logic with bytecode for a generated interpreter.

Use It For

When encrypting JavaScript is worth it

Your logic is the product — a game, a widget, an editor, a calculation others would copy.
Licence and feature checks you want to be tedious to patch out.
Strings that map your back end: endpoint paths, feature flags, internal names.
Code you ship to customers: on-premises installs, white-label scripts, Electron apps.

Do Not Rely On It For

Things only a server can keep secret

API keys, passwords and tokens. Keep them on your server; you cannot hide an API key in JavaScript.
Authorisation. Anything the page decides, a user can change; the server must check again.
Encrypting data. To encrypt data rather than code, use the Web Crypto API with a key the page does not hard-code.
Hiding a vulnerability. Obfuscation will not fix it.

Frequently Asked

JavaScript encryption questions

Can JavaScript be encrypted so that nobody can read it?

No. The browser has to run the code, so whatever decrypts it ships with it, and a debugger can stop the page after decryption. What JavaScript encryption tools offer is obfuscation: code and strings that are slow and tedious to read, not mathematically secret. More in obfuscation vs encryption, and what four deobfuscators recovered from protected code in our deobfuscator test.

Is there a free tool to encrypt JavaScript online?

Yes. The online JavaScript obfuscator needs no account and previews every option, including Encrypt Strings, on samples up to 32 KB. Encoding strings, moving them into a table and renaming variables are free for full projects too, through the CLI; Encrypt Strings needs the Enterprise plan.

What is the difference between encoding and encrypting strings?

Encoding respells each character as an escape such as \x41, which any beautifier turns back into text. Encryption stores the strings scrambled with a key and rebuilds them at run time through generated code, so they cannot be read without running or tracing that code.

How do I protect an API key in JavaScript?

You cannot, if it ships to the browser. Keep the key on your server and have the page call your server, which adds the key. Obfuscation slows down reading code; it does not keep a credential secret.

Try It

See each level on your own code

Paste a file into the online tool, tick Encode, Move or Encrypt Strings, and compare. No account needed for the preview.

Open the Online Tool › How to Protect JavaScript Code