Client-side code protection

Make your JavaScript
unreadable.

CodeOBF compiles your code into custom bytecode and runs it on a virtual machine that is re-randomized on every build — encrypted per-instruction under a key the engine only recovers by running, control-flow flattened, with a per-build instruction set and dispatch engine and an optional Rust→WebAssembly core.

Open the Obfuscator → See pricing
  • No source, strings or structure left
  • A different instruction set and dispatch engine every build
  • JavaScript or WebAssembly engine

The same technique used by commercial protectors — built from scratch, no black box.

2engines · JS + WASM
1,300+correctness tests
∞build variants
0runtime deps in output
01 — Pipeline

From source to a self-contained black box

Your code is never shipped. What ships is an interpreter executing an opaque, encrypted byte stream.

  1. 1

    Parse

    Your JS is parsed to an AST — the last time it looks like your code.

  2. 2

    Compile & fuse

    Lowered to a custom stack machine; hot sequences fuse into per-build superoperators, and whole families of operations collapse into parametric handlers keyed by a per-build selector — so there's no fixed handler to fingerprint.

  3. 3

    Flatten & encrypt

    Control flow becomes an opaque state machine whose dispatcher shape varies per build; bytecode is encrypted per-instruction with a per-build cipher structure (not just per-build keys), bound to the engine, and unlocked by a key the VM only derives by running at load. A per-function chain makes any tampered byte cascade into every later function.

  4. 4

    Emit engine

    A metamorphic VM — JavaScript, or a Rust→WebAssembly core — with new identifiers, opcodes, dispatch model and shape every build.

02 — Protection layers

Fourteen layers, stacked

Compose them for maximum resistance, or dial back for speed. Every layer is independent and toggleable per build.

Per-function protection

Emulate hides a function's math / string operations (the values are still readable in memory). No-float and No-string go further — the value itself is carried as raw integer bit-patterns / opaque code-unit arrays and never appears in memory. Those two only fit pure numeric / string kernels; a function that isn't one stays selectable but steps down (↓) to Emulate at build. Hover any mode for details.

04 — Pricing

Protect one file or your whole pipeline

One plan with everything, or self-host for total control. Try it in the obfuscator before you buy.

Recommended

Pro

$99/mo

For teams shipping protected builds.

  • All 14 protection layers
  • REST API + API keys
  • CI/CD integration
  • No file-size limit
  • Priority build queue
  • Reproducible, seeded builds
Start Pro — $99/mo

Enterprise

Custom

Self-hosted, on-prem, SLAs.

  • Everything in Pro
  • Self-host the engine
  • Per-tenant opcode maps
  • SSO & audit logs
  • Dedicated support
Contact sales

The $99 price is a placeholder value — wire in your Stripe keys (see web/PAYMENTS.md) to accept real payments.

05 — API

One endpoint. Drop it in your build.

The same engine that powers the obfuscator, callable from anywhere.


    

  


  


  

  
  

    

      06 — FAQ
      
Straight answers