Paste code, pick a preset, and obfuscate. Use Standard for quick protection, Balanced for more coverage, and Maximum when the code matters most. The engine is verified daily against 60+ real-world libraries, and JSO AI can suggest the right preset and pre-check compatibility before you protect. Move into the desktop app for batch work and larger projects.
Hosted chat, on-premise chat, AI assistants, and rich text editing tools from the same product family.
This page is optimized for fast evaluation. Paste or upload a file, review the transformed shape, and switch to the desktop app or automation docs once the preset is dialed in.
Browser-safe formatting and naming controls.
Premium feature preview. Limited to 2 KB samples on this page.
Desktop-only transforms remain visible here so you can compare the full option set before moving into the full app.
Regex per line. Names matching any pattern are kept.
Use one pattern per line for public APIs, framework hooks, or names that should stay stable across builds.
Keep moving once the preview looks right.
.js
.js/.jsx
Yes, the online tool is free and needs no account to try. It is a demo of the protection engine rather than a production pipeline, so it carries deliberate limits: uploads are capped at 16 KB, protection samples are capped at 2 KB, and the endpoint is rate limited. Options that need additional values or desktop-only processing are not applied to the preview. For real builds use the desktop app or the npm CLI, where none of those caps apply.
It is sent to the hosted service, used to generate your protected result, and the temporary upload file is removed after completion. If you would rather not send source anywhere, the local paths exist for that reason: WinUI Local Standard protects basic ES5 JavaScript entirely offline, and paid Local Advanced keeps modern JavaScript and mixed HTML or server-script source on your own device after an online entitlement check. The security processing documentation describes each path in detail.
Almost always the 2 KB sample cap or an option the preview does not run. The online demo protects up to 2 KB of source and skips options that require additional configuration values or desktop-only processing, so a large file or an advanced preset will not reflect what a real build produces. Run the same input through the desktop app or the CLI to see the full result.
It can be analysed, and no client-side protection changes that, because the browser has to execute the code you sent it. What protection changes is cost. Automated formatters restore whitespace and structure but cannot restore the names, string layout and control flow that were rewritten, so the work of understanding a protected bundle well enough to fork and maintain it is substantially larger than reading a minified one. Treat it as raising cost, not as a boundary.
Not if names that outside code depends on are excluded. The transforms preserve program behaviour, but they cannot know which identifiers are resolved by name from outside the build, such as exported API surface, framework callbacks or properties read from a template. Those go in the exclusion list. The other common cause is testing the unprotected build and shipping the protected one, so run your suite against the protected output before release.
It removes the demo limits and adds the workflows a real release needs: whole folders rather than a single snippet, mixed HTML and server-script files where the script is protected in place and the surrounding markup is left untouched, local processing that keeps source on your machine, and protection reports written locally for later symbolication. The npm CLI covers the same ground for Node-based builds and CI.