VM Obfuscation
VM obfuscation is the most advanced form of code protection. It transforms your JavaScript functions into custom bytecode that runs on a virtual machine embedded in the output. The original logic is completely hidden - no JavaScript to reverse-engineer.
In this section
Register-Based VM
Switch the VM to a register-based execution model for faster runtime, at the cost of a slightly larger bundle.
Async Executor
Run the VM asynchronously so the bytecode decryption key can be fetched at runtime instead of shipping in the bundle.
Targeting Functions
Selectively VM-obfuscate only sensitive functions for optimal performance.
Direct eval Behavior
Why direct eval() disables VM obfuscation, and how to avoid the pitfall.
Strict Mode Compatibility
Declare strict mode so the VM compiles correct bytecode.
VM Self Defending
Tamper detection, anti-hooking, and anti-agent protection for the VM runtime.
VM Debug Protection
Anti-debugging measures for VM-protected code.
VM Domain Lock
Restrict the obfuscated VM code to specific domains and sub-domains.
Browser Environment
Declare how your production build is served so the protected code can bind its integrity to it.
How VM Transforms Code
What the VM keeps visible vs. hides, and how to protect function names.
Using the NPM Package
Apply VM obfuscation from your build pipeline via the npm package.
