Protect your project. One step at a time.

1. Make one file work first

1. Download and extract the Windows app. Keep the extracted files together.
2. Open javascriptobfuscator.exe. Use the project window, then click New Project and Add Files.
3. Select a JavaScript file from your application's build output. Keep your original source unchanged.
4. In the Output: bar, choose a separate folder, such as D:\MyApp\protected. Never select your source folder.
5. Choose where protection runs. See the three choices below. Start with conservative settings; leave advanced transforms alone for now.
6. Click Obfuscate. Run the protected file in your application and check the same behavior as before.

Ready to continue? You have a protected file in the output folder, and your application test still passes.

2. Add the project and save its settings

1. Run your normal application build first. React, Vue and other module projects should be built with their existing bundler. The obfuscator does not replace that build.
2. Click Add Folder and choose the build folder containing the JavaScript you want to protect. Review each file's action before running; not every asset needs obfuscation.
3. Check the separate Output: folder again. Keep source maps, credentials and original source out of public deployment.
4. Click Save Project and save as D:\MyApp\release.jsoproj. This file remembers your selected inputs, output folder and protection settings.
5. Click Obfuscate. Test the complete protected application, including routes, forms and third-party integrations. Keep a known-good build for rollback.

Ready to automate? Close and reopen release.jsoproj, check its paths and settings, and confirm the batch works in the app.

3. Run the whole saved project from the command line

You are not connecting to an already open desktop window. The command-line tool opens the saved project and runs its selected files with the same configuration.

Open Command Prompt and run this

Replace the two example paths with your extracted app folder and saved project. Keep the quotation marks.

"C:\Tools\JavaScriptObfuscator\cli\jso-local.exe" "D:\MyApp\release.jsoproj"
echo %ERRORLEVEL%

0 means success. 1 means at least one file failed. 2 means the command or project could not be loaded. Read the error before continuing. Your output goes to the folder saved in the project.

For a first offline check, save a project containing only ES5 .js files with Local Standard selected. The same project can be run again without changing the command. This basic mode does not apply paid transforms, VM protection or modern-syntax conversion.

& "C:\Tools\JavaScriptObfuscator\cli\jso-local.exe" "D:\MyApp\release.jsoproj"
if ($LASTEXITCODE -ne 0) { throw "Protection failed. Review the command output." }

Run it again with a .cmd file

Save this as protect-project.cmd. Change both paths before running it. Run your normal build first; this file only protects the saved project's existing inputs.

@echo off
"C:\Tools\JavaScriptObfuscator\cli\jso-local.exe" "D:\MyApp\release.jsoproj"
if errorlevel 1 exit /b 1
echo Protection finished. Run your application tests next.
exit /b 0

For a build server, store JSO_API_KEY and JSO_API_PASSWORD in its secret manager when the selected mode needs credentials. Do not put real keys in this script, source control or screenshots. Source-local Advanced still needs an online plan check; hosted mode uploads selected source.

Do not deploy on command success alone. Run your application tests against the protected output and stop the release if either protection or application tests fail.

Where should I look when something fails?

Need help? Send support your app version, processing mode, failing step and error message. Never send passwords or API keys.