Runtime compatibility

target

• browser - Chrome, Firefox, Safari, Edge.
• browser-no-eval - same as browser, but the output does not use eval(). Use when the target page has a Content Security Policy that forbids eval/unsafe-eval.
• node - Node.js environment. Browser-specific options are disabled (they require window/document and would be no-ops or throw in Node). Some vmSelfDefending defenses that rely on browser-only APIs - headless-browser detection, iframe-based clean-realm recovery, anti-inspector/DOM checks - are not emitted for this target.
• service-worker - Service Worker context. No window, no document, different self global.
• userscript - userscript manager sandbox (e.g. Tampermonkey). vmSelfDefending defences are adjusted accordingly. Requires obfuscator v6.9.0+.
• bytenode - for code that will be compiled to .jsc with bytenode. Requires obfuscator v6.13.0+.

JavaScript

Function names and function source text can change with obfuscation. Do not use .name or .toString() as stable application data; use explicit identifiers instead. Public globals may remain visible when required by your settings.

strictMode

strictMode: null and strictMode: false still recognize explicit directives, ES modules, and class methods as strict. strictMode: true treats all input as strict. Match the final runtime context; a bundler adding strict mode after obfuscation can change behavior.

CLI / API

Compile TypeScript or JSX and bundle your application before the final obfuscation step. Preserve VM selection comments until obfuscation. Do not minify, format, or otherwise rewrite self-defending output afterward. Source maps are unavailable for VM and HTML obfuscation. For functional tests that use agents, automation, or debuggers, see Testing and CI.