Recipes
Opinionated, end-to-end walkthroughs for common javascript-obfuscator integration problems. Each recipe focuses on how to combine options to achieve a specific outcome rather than documenting individual flags.
Pick the recipe that matches the problem you're trying to solve. More recipes will be added over time - if you've hit an integration scenario that isn't covered here, let us know and we'll write it up.
In this section
Best Practices
What to protect, what to leave alone, and what obfuscation cannot do for you.
Host-side Template Substitution
Inject server-rendered values into VM-obfuscated JavaScript using reservedNames and reservedStrings.
Bytecode Array Encoding Key
Supply your own VM bytecode encryption key with vmBytecodeArrayEncodingKey and resolve it at runtime with a key getter — from client storage, or fetched from your backend.
VM Defense Telemetry & Reactions
Report VM defense detections to your backend with vmDefenseHook, and tune how each detection category reacts with vmDefenseReaction.
Hiding Function Names from LLM Analysis
Why VM-obfuscated code can leak meaningful function names to an LLM, and how an IIFE wrap removes the leak.
VM Obfuscation with eval and new Function
How VM obfuscation handles direct eval and Function-constructor calls, what gets bytecoded versus skipped, the warnings the obfuscator emits, and how to diagnose ReferenceError at runtime.
Avoiding Identifier Collisions
Why bundling multiple VM-obfuscated files can throw "Identifier already declared" at parse time, and how to fix it with random or hexadecimal identifiers.
Diagnosing VM Runtime Errors
Step-by-step checklist for VM runtime errors like "Invalid array length", separating target/self-defending misconfiguration from real bugs.