Obfuscator.io

Obfuscator.io

Documentation
/
Recipes
/

HTML Obfuscation

Obfuscating HTML Files

Pro

With a paid plan, you can obfuscate HTML files containing inline JavaScript. The obfuscator extracts the marked <script> tags, obfuscates their contents, and preserves the surrounding HTML - works with both basic and VM obfuscation.

Enable the Parse HTML option and the obfuscator will automatically extract <script> tags, obfuscate their contents, and preserve the HTML structure.

How it works: The obfuscator parses your HTML and finds non-empty inline <script> tags marked with the data-javascript-obfuscator attribute. Each marked script is obfuscated individually, and the complete HTML is output with protected scripts. Scripts with src or type="module" are skipped even when they carry the attribute.

Important: Code inside each data-javascript-obfuscator script tag must be self-contained. Scripts are obfuscated individually, so do not depend on names renamed inside another marked script. Unmarked scripts can still use globals that protected scripts explicitly preserve (via var declarations or globalThis assignments).

Example

Input HTML

HTML

After obfuscation, only scripts with the data-javascript-obfuscator attribute are transformed. All other content remains unchanged.

Limitations

Usage calculation: Usage is charged for the JavaScript selected for obfuscation, subject to the minimum charge per job, not the full HTML file size. However, the maximum upload file size limit applies to the entire HTML file.

Evaluate output disabled: When Parse HTML is enabled, the "Evaluate output" feature is disabled since HTML cannot be executed as JavaScript.

  • Only non-empty inline scripts with the data-javascript-obfuscator attribute are obfuscated
  • Scripts with src or type="module" are left unchanged, even with the attribute
  • Each script tag is obfuscated individually - code must be self-contained and cannot reference names renamed in other marked script tags
  • Event handler attributes (onclick, onload, etc.) are not obfuscated
  • JavaScript URLs (javascript: protocol) are not obfuscated
  • Scripts inside HTML comments are ignored
  • Source maps are not supported when Parse HTML is enabled