See every transform side-by-side

standard 1. Name Mangling

Local identifiers (variables, parameters, function names) collapse to short, opaque tokens. Public/global names you list as reserved are left alone.

function calculateLicenseHash(productKey, accountId) {
    const salt = "JSO-2026";
    return productKey + ":" + accountId + ":" + salt;
}

function _0x4f2a(_0xae,_0x21){
    const _0xbc="JSO-2026";
    return _0xae+":"+_0x21+":"+_0xbc;
}

balanced 2. String Array (Move Strings Into Array)

Every string literal is hoisted into a single array at the top, accessed by index. Static analyzers can no longer grep the bundle for revealing strings; they have to follow the indirection.

function greet(user) {
    if (user.role === "admin") {
        return "Welcome, administrator!";
    }
    return "Hello, " + user.name;
}

var _$a=["admin","Welcome, administrator!","Hello, ","role","name"];
function _g(u){
    if(u[_$a[3]]===_$a[0]){
        return _$a[1];
    }
    return _$a[2]+u[_$a[4]];
}

balanced 3. String Encryption

The hoisted string array is hidden until the protected file runs. Searching the shipped file for "Welcome" no longer reveals the original message.

function greet(user) {
    if (user.role === "admin") {
        return "Welcome, administrator!";
    }
    return "Hello, " + user.name;
}

var _$e=["bER0aW4=","V2VsY29tZSwgYWRtaW5pc3RyYXRvciE=",
         "SGVsbG8sIA==","cm9sZQ==","bmFtZQ=="];
(function(a,b){var c=function(i){return atob(a[i]);};
 _$d=function(i){return c(i);};})(_$e);
function _g(u){
    if(u[_$d(3)]===_$d(0))return _$d(1);
    return _$d(2)+u[_$d(4)];
}

maximum 4. Control Flow Flattening (Flat Transform)

Linear code becomes a state-machine loop. Automated readers must work through that new structure before they can understand the original branches.

function sum(n) {
    let total = 0;
    for (let i = 1; i <= n; i++) {
        total += i;
    }
    return total;
}

function _s(n){
    var _st="3|0|4|2|1".split("|"),_i=0,_t,_x;
    while(true){
        switch(_st[_i++]){
            case "0": _t=0; continue;
            case "1": return _t;
            case "2": if(_x>n){_i=4;continue;} _t+=_x; _x++; _i=2; continue;
            case "3": _x=1; continue;
            case "4": _i=1; continue;
        }
        break;
    }
}

maximum 5. Dead Code Insertion

Provably unreachable branches are spliced in alongside real logic. The bundle grows; the reader gets more code paths to chase before realizing most of them are decoys.

function isPaid(user) {
    return user.tier >= 2;
}

function _ip(u){
    if(!![]){
        return u["tier"]>=2;
    }else{
        var _z=function(a){return a*0x71+0x1f;};
        for(var i=0;i<3;i++){_z(i);}
        throw new Error("never");
    }
}

maximum 6. Protect Members & Member Mapping

Object property names that don't escape the bundle (e.g. internal helpers) are renamed too. Combined with the string array, even structured access becomes opaque.

const license = {
    productKey: "ABC-123",
    expires: "2027-01-01",
    isValid() { return Date.now() < Date.parse(this.expires); }
};

var _$m=["ABC-123","2027-01-01"];
const _l={
    _0xae: _$m[0],
    _0xbf: _$m[1],
    _0xc1(){ return Date.now() < Date.parse(this._0xbf); }
};

maximum 7. Self-Defending Integrity Guard

A small heartbeat function checks that the protected bundle was not edited or re-formatted after shipping. Any modification — even a single whitespace change — trips the guard and the configured runtime defense action fires.

function chargeCard(amount) {
    api.post("/charge", {amount});
}

(function _sd(){
    var _exp="a7c9...c2";
    var _f=arguments.callee.toString().replace(/[^a-z0-9]/gi,"");
    var _h=0; for(var i=0;i<_f.length;i++)_h=(_h*31+_f.charCodeAt(i))>>>0;
    if(_h.toString(16)!==_exp){ window.__jso_tamper(); return; }
    setTimeout(_sd, 5000);
})();
function _c(_a){_api.post("/charge",{amount:_a});}

Frequently asked questions

Are these examples real output from the engine?

They are representative rather than byte-exact, and the distinction matters. Generated identifiers vary from build to build, string table indices depend on how many literals a file contains, and the runtime helpers a transform emits are sized to the program they are protecting. What the examples show accurately is the shape of each transformation and its direction of travel: what disappears, what is introduced, and roughly what happens to size. Run your own file through the online tool to see the exact output for your code.

Which of these should we turn on first?

Name mangling, on its own, until you have a protected build passing your test suite. It is the transform with the widest compatibility, the smallest output, and the fewest ways to surprise you. Once that is routine, add the string transforms, which are where most of the readability cost comes from for most codebases. Leave the structural transforms and the runtime guards for last, because they are the ones that change how the program executes rather than only how it reads.

Why do some transforms make the file larger?

Because they add machinery that did not exist in your source. A string table adds an array and an accessor function. Control-flow flattening replaces straight-line code with a dispatch structure. Dead code insertion adds statements on purpose. Name mangling usually shrinks output, and compression can recover a good deal of the rest, but a protected bundle is generally bigger than a minified one and it is better to plan for that than to discover it in a performance review.

Do these transforms change what my program does?

They are intended to preserve behaviour, and the ones that most often appear to break something usually turn out to have renamed a name that something outside the file depended on. A template referring to a function, a framework matching on a property, a test asserting on an identifier. That is why member renaming is presented here as a maximum-mode transform with exclusion rules rather than something to enable globally, and why running your real test suite against protected output is the recommendation on every page of this site.

Which of these are available on the free online tool?

The online tool runs a preview with deliberate limits: uploads are capped, the protected sample is capped, the endpoint is rate limited, and options that need extra values or desktop-only processing are skipped rather than silently half applied. It is designed to show you what a transform does to your code, not to produce a release artifact. Use the desktop application or the command line tool for real builds, where nothing is capped and every option is available according to your plan.

Where can I read what each transform is actually doing?

Each one has a reference page with its configuration, its trade-offs and its failure modes, linked from the documentation index. The techniques article covers the same ground as prose if you want the reasoning before the reference. If you are comparing against a configuration you already have from another tool, the migration page maps the upstream option names onto these transforms, including the two cases where one upstream flag corresponds to two settings here.