Run the VM asynchronously so the bytecode decryption key can be fetched at runtime instead of shipping inside the bundle.

The vmAsyncExecutor option enables the asynchronous VM executor. Its headline benefit is that vmBytecodeArrayEncodingKeyGetter may now return a Promise — an asynchronous key getter — so the decryption key can come from a network request, IndexedDB, or any async source at load time rather than being available synchronously when the code first runs.

For a complete backend-fetched-key walkthrough, see the recipe Fetching the Bytecode Array Key from Backend.

When to use it

Heavily recommended for fully async codebases. In this mode only async functions are virtualized — a synchronous function cannot be made async without turning its return value into a Promise and breaking its callers — so code that is async throughout gets the most coverage. It still works when the root is synchronous (for example a sync IIFE or UMD wrapper): the outermost async functions inside are protected, and the sync parts are left as-is.

What gets transformed

Every outermost async function, wherever it appears (including nested inside sync wrappers). The outermost async in each chain is the protected unit — everything inside it, sync and async, is compiled in. Synchronous functions and plain generators are left unobfuscated.

function foo() {              // sync — left as-is
    function bar() {}         // sync — left as-is

    async function baz() {    // transformed
        // any code here, including calls to other async or sync functions
    }

    async function bark() {   // transformed
        // any code here, including calls to other async or sync functions
    }
}

Skips and warnings

Async generators are also left unobfuscated when an asynchronous key getter is active — an async generator must return its iterator synchronously and cannot wait for the key. In the default vmTargetFunctionsMode: 'root' skips are silent (selection is automatic). In 'comment' mode a warning is emitted through ObfuscationResult.getWarnings() whenever a function you explicitly marked cannot be virtualized — it turned out synchronous, or it is an async generator under an async key getter.

Requirements

• The asynchronous key getter requires vmBytecodeArrayEncoding together with a vmBytecodeArrayEncodingKeyGetter.
• Obfuscator version 7.3.0 or later.

Example

JavaScriptObfuscator.obfuscate(code, {
    vmObfuscation: true,
    vmAsyncExecutor: true,
    vmBytecodeArrayEncoding: true,
    vmBytecodeArrayEncodingKey: 'mySecretKey123',
    // the key getter may now return a Promise
    vmBytecodeArrayEncodingKeyGetter: 'fetch("/vm-key").then((res) => res.text())'
});