VM Obfuscation
VM obfuscation is the most advanced form of code protection. It transforms your JavaScript functions into custom bytecode that runs on a virtual machine embedded in the output. The original logic is completely hidden - no JavaScript to reverse-engineer.
In this section
How VM Transforms Code
What the VM keeps visible vs. hides, and how to protect function names.
Targeting Functions
Selectively VM-obfuscate only sensitive functions for optimal performance.
Register-Based VM
Switch the VM to a register-based execution model for faster runtime, at the cost of a slightly larger bundle.
Async Executor
Run the VM asynchronously so the bytecode decryption key can be fetched at runtime instead of shipping in the bundle.
Strict Mode Compatibility
Declare strict mode so the VM compiles correct bytecode.
Direct eval Behavior
Why direct eval() disables VM obfuscation, and how to avoid the pitfall.
VM Self Defending
Tamper detection, anti-hooking, and anti-agent protection for the VM runtime.
VM Debug Protection
Anti-debugging measures for VM-protected code.
VM Domain Lock
Restrict the obfuscated VM code to specific domains and sub-domains.
Browser Environment
Declare how your production build is served so the protected code can bind its integrity to it.
Using the NPM Package
Apply VM obfuscation from your build pipeline via the npm package.