Obfuscator.io

Obfuscator.io

Documentation
/

Runtime Compatibility

Runtime Compatibility

Choose the target for the actual runtime. Browser and Node builds can contain different defenses; a browser target is not a substitute for Node.

target

  • browser - Chrome, Firefox, Safari, Edge.
  • browser-no-eval - same as browser, but the output does not use eval(). Use when the target page has a Content Security Policy that forbids eval/unsafe-eval.
  • node - Node.js environment. Browser-specific options are disabled (they require window/document and would be no-ops or throw in Node). Some vmSelfDefending defenses that rely on browser-only APIs - headless-browser detection, iframe-based clean-realm recovery, anti-inspector/DOM checks - are not emitted for this target.
  • service-worker - Service Worker context. No window, no document, different self global.
  • userscript - userscript manager sandbox (e.g. Tampermonkey). vmSelfDefending defenses are adjusted accordingly. Requires VM Obfuscation (or Parse HTML) and obfuscator v6.9.0+.
  • bytenode - for code that will be compiled to .jsc with bytenode. Requires VM Obfuscation (or Parse HTML) and obfuscator v6.13.0+.

Browser environment and domains

Declarations about where the code runs must match the real deployment. browserEnvironment must describe how the build is actually served (see Browser Environment), and VM Domain Lock must list every domain that serves it (see VM Domain Lock). Automation and debuggers can trigger advanced defenses; see Testing and CI.

JavaScript

Function names and function source text can change with obfuscation. Do not use .name or .toString() as stable application data; use explicit identifiers instead. Public globals may remain visible when required by your settings.

strictMode

strictMode: null and strictMode: false still recognize explicit directives, ES modules, and class methods as strict. strictMode: true treats all input as strict. Match the final runtime context; a bundler adding strict mode after obfuscation can change behavior.

Build pipeline

Compile TypeScript or JSX and bundle your application before the final obfuscation step. Keep the /* javascript-obfuscator:vm */ comments through that build so comment mode can still find them. Do not minify, format, or otherwise rewrite Self Defending or VM Self Defending output afterward. Source maps are unavailable for VM and HTML obfuscation.