747

I want to make a JavaScript application that's not open source, and thus I wish to learn how to can obfuscate my JS code? Is this possible?

23
  • 16
    I'd be interested to hear the reason you are trying to obfuscate the code, it might give some needed context to give a helpful answer.
    – JohnFx
    Jan 24, 2009 at 0:46
  • 49
    The only way to truly keep something secret is to not send it to the client. If they don't have it, they can't read it. Sending it encrypted is just asking for trouble at the hands of the few people who actually care, and everyone else won't poke around even if you send it in the clear (c.f. DRM). Jun 8, 2010 at 20:42
  • 10
  • 10
    Obfuscating your code is not a good idea. It will only inconvenience legitimate users (eg. when they need to fix a bug), and do nothing to 'protect' it from people who have a (financial) incentive to reverse-engineer it. It is fundamentally impossible to prevent reverse-engineering of Javascript code. Mar 29, 2015 at 18:53
  • 22
    The argument not to obfuscate seems flawed to me. Unless you really think your users might fix/report bugs, then you should do it. It can decrease load times by minifying. It will never stop a really dedicated hacker, but it will slow him/her down and it will stop half-arsed hack attempts. It's very easy to do and there are many tools (see other answers), I'd say certainly do it as there are only advantages most of the time, but don't expect it to bring real security or to stop someone copying your code if they really want to. The only way to do this is to keep code server side and use ajax.
    – Benjamin
    Mar 27, 2016 at 20:09

22 Answers 22

431

Obfuscation:

Try YUI Compressor. It's a very popular tool, built, enhanced and maintained by the Yahoo UI team.

You may also use:

UPDATE: This question was originally asked on 2008, and The mentioned technologies are deprecated. you can use:

Private String Data:

Keeping string values private is a different concern, and obfuscation won't really be of much benefit. Of course, by packaging up your source into a garbled, minified mess, you have a light version of security through obscurity. Most of the time, it's your user who is viewing the source, and the string values on the client are intended for their use, so that sort of private string value isn't often necessary.

If you really had a value that you never wanted a user to see, you would have a couple of options. First, you could do some kind of encryption, which is decrypted at page load. That would probably be one of the most secure options, but also a lot of work which may be unnecessary. You could probably base64 encode some string values, and that would be easier.. but someone who really wanted those string values could easily decode them. Encryption is the only way to truly prevent anyone from accessing your data, and most people find that to be more security than they need.

Sidenote:

Obfuscation in Javascript has been known to cause some bugs. The obfuscators are getting a little better about it, but many outfits decide that they see enough benefit from minifying and gzipping, and the added savings of obfuscation isn't always worth the trouble. If you're trying to protect your source, maybe you'll decide that it's worth your while, just to make your code harder to read. JSMin is a good alternative.

10
  • 37
    I want to add that doing a base64 encode will be of no benefit to security, since it is a trivially reversable procedure. Even encrypting it won't help if it's decrypted client-side. The only way to ensure security of a string is to have the client ONLY see the encrypted string, and it is passed to
    – Claudiu
    Oct 11, 2008 at 21:13
  • 18
    the server for further processing.
    – Claudiu
    Oct 11, 2008 at 21:14
  • 10
    FYI, online YUI compressor may be found here: refresh-sf.com/yui
    – mtness
    Jan 19, 2010 at 14:45
  • 10
    Encrypting the string values will be only of marginally more benefit than base64 encoding them, if they have to be decrypted by the browser to use them. The reason is that you'll have to give the browser the encryption key as well, and anything the browser can do the user can too.
    – Ben
    Jan 1, 2012 at 5:27
  • 9
    When I do my minifying with YUI Compressor I make sure it uses "safe" minification methods, ie it keeps the semi-colons --preserve-semi. Rewriting the private variables to a, b, c etc is usually safe. Another thing I do is make the minifier put a line break after each semi-colon in the code --line-break 0. Then in production if it errors I least have a valid reference line to work from and can find that code in my development copy. Otherwise you just end up with an error on a massive line of code and no idea where the error is.
    – zuallauz
    Feb 15, 2013 at 1:36
142

I'm surprised no one has mentioned Google's Closure Compiler. It doesn't just minify/compress, it analyzes to find and remove unused code, and rewrites for maximum minification. It can also do type checking and will warn about syntax errors.

JQuery recently switched from YUI Compresser to Closure Compiler, and saw a "solid improvement"

5
  • 65
    yes, but recently they left Closure compiler and are using UglifyJS now. The JQuery code was buggy after compressing with closure compiler
    – Chielus
    May 24, 2011 at 7:32
  • I would like to note that, if your working with angular. this tool won't really work because of the dependency injection and the renaming of arguments, unless there is a checkbox I can't see.
    – iConnor
    Aug 16, 2013 at 23:41
  • 1
    Useful tool, but it doesn't do obfuscation which is probably why nobody else had mentioned it.
    – Madbreaks
    Mar 25, 2014 at 23:18
  • 1
    @Madbreaks with Advanced Optimizations (developers.google.com/closure/compiler/docs/api-tutorial3) it will minify the code to the point of obfuscation. Variables can be renamed for brevity, for instance.
    – Jason Hall
    Mar 26, 2014 at 22:43
  • Google is not an option for security either Oct 17, 2018 at 0:44
128

Obfuscation can never really work. For anyone who really wants to get at your code, it's just a speed bump. Worse, it keeps your users from fixing bugs (and shipping the fixes back to you), and makes it harder for you to diagnose problems in the field. Its a waste of your time and money.

Talk to a lawyer about intellectual property law and what your legal options are. "Open Source" does not mean "people can read the source". Instead, Open Source is a particular licensing model granting permission to freely use and modify your code. If you don't grant such a license then people copying your code are in violation and (in most of the world) you have legal options to stop them.

The only way you can really protect your code is to not ship it. Move the important code server-side and have your public Javascript code do Ajax calls to it.

See my full answer about obfuscators here.

17
  • 24
    Lawyers probably create more costs/issues than the lost code, think very carefully and arrange lots of money to engage lawyers!!
    – andora
    Mar 10, 2011 at 13:14
  • 14
    -1: I believe that finding a lawyer that understand JavaScript would be hard... Not to the mention the fees and the amount of time needed to find "violators". Can someone really be violating a license that is buried in the HTML/JavaScript files if he never signed anything? +1 for the AJAX calls.
    – Alerty
    Oct 30, 2011 at 17:14
  • 16
    @Alerty 1) Licenses fundamentally are about granting use of copyrighted material. You have little right to use it without the license. You don't have to sign it to get the rights. A license is different from a contract. 2a) Since the question is about people copying and using the HTML/Javascript without permission, the license is not "buried", it's right there on the thing being taken. 2b) You have little right to use someone else's copyrighted material without a license. 3) The lawyer does not need to understand Javascript, just intellectual property law.
    – Schwern
    Oct 31, 2011 at 19:06
  • 6
    @Alerty Don't be obtuse. This is about punishing those who copy the file for use on their own site without permission. What you're talking about is a contract, not a license. Contracts require mutual assent and are a give and take. Licenses grant you right to use intellectual property. Licenses are one way (the owner is granting you things), you are not required to sign because you are not giving anything away. Many "Software License Agreements" are actually contracts because they go beyond licensing the property and into sometimes ridiculous things like right to sue.
    – Schwern
    Nov 2, 2011 at 0:01
  • 3
    Down-voted for saying 'hire a lawyer'. What an obnoxious statement. You cannot copyright Javascript that is ran on the WWW.That's like the same logic as copyrighting a custom CSS class. Good luck. May 18, 2015 at 5:20
49

You can obfuscate the javascript source all you want, but it will always be reverse-engineerable just by virtue of requiring all the source code to actually run on the client machine... the best option I can think of is having all your processing done with server-side code, and all the client code javascript does is send requests for processing to the server itself. Otherwise, anyone will always be able to keep track of all operations that the code is doing.

Someone mentioned base64 to keep strings safe. This is a terrible idea. Base64 is immediately recognizable by the types of people who would want to reverse engineer your code. The first thing they'll do is unencode it and see what it is.

8
  • 66
    Wherever I go, the most common answer to "how can I obfuscate my Javascript?" is "you shouldn't worry about that because someone could un-obfuscate it." This is not really an answer. Jul 31, 2009 at 16:00
  • 2
    @Vivek: A bit late, but what I really meant is "server-side code". It is possible to run javascript not in a browser, just on a server, but I don't know how common that is.
    – Claudiu
    Oct 6, 2010 at 22:00
  • 8
    @Travis: I didn't say "you shouldn't worry about it." I just said that if you want a closed-source program, you're not going to want to write it in client-side javascript, because any obfuscation you do will not prevent it from being (pretty easily) reverse-engineered.
    – Claudiu
    Oct 6, 2010 at 22:01
  • 9
    Right. Which in no way answers "how can I obfuscate my JavaScript". Obfuscation isn't an abstract concept, it's a technical one. The op simply asked "how?"
    – Madbreaks
    Mar 19, 2014 at 6:10
  • 2
    @Madbreaks: The question was in the context of not making his code open source. The immediate technical answer is the accepted one, but the better in-context answer (as in, what are you really trying to do?) is, IMO, that you cannot have client-side javascript that isn't open-source, because everybody has the source, regardless of how you obfuscate it. Either way both answers are here and people can read and benefit from both.
    – Claudiu
    Mar 19, 2014 at 6:58
45

There are a number of JavaScript obfuscation tools that are freely available; however, I think it's important to note that it is difficult to obfuscate JavaScript to the point where it cannot be reverse-engineered.

To that end, there are several options that I've used to some degree overtime:

  • YUI Compressor. Yahoo!'s JavaScript compressor does a good job of condensing the code that will improve its load time. There is a small level of obfuscation that works relatively well. Essentially, Compressor will change function names, remove white space, and modify local variables. This is what I use most often. This is an open-source Java-based tool.

  • JSMin is a tool written by Douglas Crockford that seeks to minify your JavaScript source. In Crockford's own words, "JSMin does not obfuscate, but it does uglify." It's primary goal is to minify the size of your source for faster loading in browsers.

  • Free JavaScript Obfuscator. This is a web-based tool that attempts to obfuscate your code by actually encoding it. I think that the trade-offs of its form of encoding (or obfuscation) could come at the cost of filesize; however, that's a matter of personal preference.

7
  • 20
    Since the Javascript code must run on the client's machine it is not just difficult to obfuscate to the point where code can not be reversed-engineered but impossible.
    – Schwern
    Oct 25, 2008 at 23:27
  • 23
    it's about statistics. what's the threshold that someone is going to get access to your code at with obfuscation and without? they can still get access, but the higher the threshold, the fewer the people. the fewer people know about something, the safer that something. standard security classification practice. Feb 22, 2012 at 11:45
  • 1
    @PeterR search/replace in a text editor is going to make your life that much more difficult trying to read it or reverse engineer it. it's not perfect, but does add an extra layer of annoyance/difficulty by removing context clues. most programmers aren't as smart as you, which is what makes this such a great deterrent.
    – SED
    Aug 22, 2017 at 23:06
  • 1
    @SED I don't know a single programmer that couldn't find/replace a bunch of [ZER0O00OIFY, ZER0000OIFY, ZEROO00OIFY, ZEROOO0OIFY] vars into at least [var1, var2,..] within a single minute. I can literally de-uglify, re-indent, and search/replace var names within two minutes. And no, I'm any smarter than an average Jr. Dev. The simple fact is, there is NO way to obscure client side JS. You can buy yourself 5 minutes, MAX, but that's of no use. This stuff is really just to sell someone who doesn't know code on added "Security". No one who has ever written a line of JS would buy that crap.
    – Peter R
    Aug 23, 2017 at 7:11
  • 4
    @PeterR "I can literally de-uglify, re-indent, and search/replace var names within two minutes" -- sure, go ahead and try that on a multi-pass minified, obfuscated, 20MB codebase bundle with a structure that takes weeks to understand even with the original, commented source code. And to make it even harder, obfuscation tools exist that deliberately make your code broken if indentation, lines, etc. change.
    – John Weisz
    Apr 1, 2019 at 20:53
29

What i would do:

A. Troll the hacker!

This is will be in the second part my fake/obfuscated secret javascript code LAUNCHER. The one you see in the source code.

What does this code?

  1. loads the real code
  2. sets a custom header
  3. posts a custom variable

var ajax=function(a,b,d,c,e,f){
 e=new FormData();
 for(f in d){e.append(f,d[f]);};
 c=new XMLHttpRequest();
 c.open('POST',a);
 c.setRequestHeader("Troll1","lol");
 c.onload=b;
 c.send(e);
};
window.onload=function(){
 ajax('Troll.php',function(){
  (new Function(atob(this.response)))()
 },{'Troll2':'lol'});
}

B. Obfuscate the code a little

What is that?

  1. thats the same code as above in base64
  2. this is not the SECRET javascript code

(new Function(atob('dmFyIGFqYXg9ZnVuY3Rpb24oYSxiLGQsYyxlLGYpe2U9bmV3IEZvcm1EYXRhKCk7Zm9yKGYgaW4gZCl7ZS5hcHBlbmQoZixkW2ZdKTt9O2M9bmV3IFhNTEh0dHBSZXF1ZXN0KCk7Yy5vcGVuKCdQT1NUJyxhKTtjLnNldFJlcXVlc3RIZWFkZXIoIlRyb2xsMSIsImxvbCIpO2Mub25sb2FkPWI7Yy5zZW5kKGUpO307d2luZG93Lm9ubG9hZD1mdW5jdGlvbigpe2FqYXgoJ1Ryb2xsLnBocCcsZnVuY3Rpb24oKXsgKG5ldyBGdW5jdGlvbihhdG9iKHRoaXMucmVzcG9uc2UpKSkoKX0seydUcm9sbDInOidsb2wnfSk7fQ==')))()

C Create a hard to display php file with the real code inside

What does this php code?

  1. Checks for the right referrer (domain/dir/code of your launcher)
  2. Checks for the custom HEADER
  3. Checks for the custom POST variable

If everything is ok it will show you the right code else a fake code or ban ip, close page.. whatever.

<?php
$t1=apache_request_headers();
if(base64_encode($_SERVER['HTTP_REFERER'])=='aHR0cDovL2hlcmUuaXMvbXkvbGF1bmNoZXIuaHRtbA=='&&$_POST['Troll2']=='lol'&&$t1['Troll1']='lol'){
 echo 'ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKSkuaW5uZXJUZXh0PSdBd2Vzb21lJzsNCg==';//here is the SECRET javascript code
}else{
 echo 'd2luZG93Lm9wZW4oJycsICdfc2VsZicsICcnKTt3aW5kb3cuY2xvc2UoKTs=';
};
?>

base64 referrer = http://here.is/my/launcher.html

SECRET javascript = document.body.appendChild(document.createElement('div')).innerText='Awesome';

FAKE = window.open('', '_self', '');window.close();

Now .. if you define event handlers in the SECRET javascript it's probably accessible.. you need to define them outside with the launchcode and pointing to a nested SECRET function.

SO... is there a easy wayto get the code? document.body.appendChild(document.createElement('div')).innerText='Awesome';

I'm not sure if this works but i'm using chrome and checked Elements,Resources,Network,Sources,Timeline,Profiles,Audits but i didn't find the line above.

note1: if u open the Troll.php url from Inspect element->network in chrome you get the fake code.

note2: the whole code is written for modern browsers. polyfill needs alot more code.

EDIT

launcher.html

<!doctype html><html><head><meta charset="utf-8"><title></title><script src="data:application/javascript;base64,KG5ldyBGdW5jdGlvbihhdG9iKCdkbUZ5SUdGcVlYZzlablZ1WTNScGIyNG9ZU3hpTEdRc1l5eGxMR1lwZTJVOWJtVjNJRVp2Y20xRVlYUmhLQ2s3Wm05eUtHWWdhVzRnWkNsN1pTNWhjSEJsYm1Rb1ppeGtXMlpkS1R0OU8yTTlibVYzSUZoTlRFaDBkSEJTWlhGMVpYTjBLQ2s3WXk1dmNHVnVLQ2RRVDFOVUp5eGhLVHRqTG5ObGRGSmxjWFZsYzNSSVpXRmtaWElvSWxSeWIyeHNNU0lzSW14dmJDSXBPMk11YjI1c2IyRmtQV0k3WXk1elpXNWtLR1VwTzMwN2QybHVaRzkzTG05dWJHOWhaRDFtZFc1amRHbHZiaWdwZTJGcVlYZ29KMVJ5YjJ4c0xuQm9jQ2NzWm5WdVkzUnBiMjRvS1hzZ0tHNWxkeUJHZFc1amRHbHZiaWhoZEc5aUtIUm9hWE11Y21WemNHOXVjMlVwS1Nrb0tYMHNleWRVY205c2JESW5PaWRzYjJ3bmZTazdmUT09JykpKSgp"></script></head><body></body></html>

Troll.php

<?php $t1=apache_request_headers();if(/*base64_encode($_SERVER['HTTP_REFERER'])=='PUT THE LAUNCHER REFERER HERE'&&*/$_POST['Troll2']=='lol'&&$t1['Troll1']='lol'){echo 'ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKSkuaW5uZXJUZXh0PSdBd2Vzb21lJzsNCg==';}else{echo 'd2luZG93Lm9wZW4oJycsICdfc2VsZicsICcnKTt3aW5kb3cuY2xvc2UoKTs=';}; ?>
4
  • 2
    oh and yes i would also obfuscate the javascript code.
    – cocco
    Jul 4, 2013 at 11:14
  • 1
    This is something I was just thinking about, trolling the cracker. I would like to see something like this without having to use PHP :) May 19, 2015 at 17:33
  • 9
    Even if this is funny, a web developer who is able to properly inspect the site, can somehow get the source code. I really think that there is no way to hide any type of data at the moment you put it online.
    – cocco
    May 19, 2015 at 17:38
  • It is not any kind of obfuscation i think. however knows how to open console, he might also know about base64 encoding/decoding, very simple.
    – T.Todua
    Dec 14, 2017 at 11:44
20

The problem with interpreted languages, is that you send the source to get them working (unless you have a compiler to bytecode, but then again, it is quite trivial to decompile).

So, if you don't want to sacrifice performance, you can only act on variable and function names, eg. replacing them with a, b... aa, ab... or a101, a102, etc. And, of course, remove as much space/newlines as you can (that's what so called JS compressors do).
Obfuscating strings will have a performance hit, if you have to encrypt them and decrypt them in real time. Plus a JS debugger can show the final values...

0
20

Try JScrambler. I gave it a spin recently and was impressed by it. It provides a set of templates for obfuscation with predefined settings for those who don't care much about the details and just want to get it done quickly. You can also create custom obfuscation by choosing whatever transformations/techniques you want.

6
  • 8
    JScrambler subscription is very very expensive... Cheapest subscription require minimum 3 month price $145 - it's crazy.
    – barbushin
    Aug 11, 2013 at 11:16
  • 1
    They now have a free plan. The other subscription plans are still that pricy.
    – user7610
    Sep 1, 2013 at 21:30
  • 2
    The free plan only includes optimization and minification. Oct 24, 2014 at 15:49
  • 1
    'The free plan includes optimization and minification', yeah no. Obfuscation and optimization don't go together, sorry. May 18, 2015 at 5:17
  • 2
    Looking at JScrambler's website today and more-so pricing plans I can't see a free option. Only a free trial..
    – KDT
    Jan 30, 2016 at 17:54
18

Contrary to most of the other answers I suggest against YUI Compressor; you should use Google Closure.

Not much because it compresses more, but mostly because it will catch javascript errors such as a = [1,2,3,]; which make IE go haywire.

1
  • 5
    shouldn't checking your code against errors and incompatibility be done either way before obfuscating?? has nothing to do with obfuscating actually
    – phil294
    Nov 29, 2015 at 13:35
12

I can recommend JavaScript Utility by Patrick J. O'Neil. It can obfuscate/compact and compress and it seems to be pretty good at these. That said, I never tried integrating it in a build script of any kind.

As for obfuscating vs. minifying - I am not a big fan of the former. It makes debugging impossible (Error at line 1... "wait, there is only one line") and they always take time to unpack. But if you need to... well.

3
  • 1
    But obfuscating doesn't necessarily compress it to one line, it could be as simple as changing the function and variable names or converting strings to base64. Minifying puts all the code on one line.
    – rw-nandemo
    Jun 18, 2014 at 16:19
  • Nowadays UglifyJS seems to be the best choice. The author is a cool guy too! :) Feb 17, 2016 at 13:47
  • Regarding debugging, you can mostly generate sourcemaps which you can include when testing so you can see on which line an error occurred, even if it's minified.
    – Luca Steeb
    Aug 4, 2016 at 12:26
11

A non-open-source Javascript-based application is fairly silly. Javascript is a client-side interpreted language.. Obfuscation isn't much protection..

JS obfuscation is usually done to reduce the size of the script, rather than "protect" it. If you are in a situation where you don't want your code to be public, Javascript isn't the right language..

There are plenty of tools around, but most have the word "compressor" (or "minifier") in its name for a reason..

10

You can't secure client side code: just press F12 on Google Chrome, pause javascript execution and you will get all strings, even those encrypted. Beautify it and rename variables and you will get almost the original code.

If you're writing server side javascript (i.e. NodeJS) is afraid of someone hacking into your server and want to make the hacker work more difficult, giving you more time to get your access back, then use javacript compilers:

You need to use Closure Compiler on Advanced Compilation, as it's the only tool that renames all your variables, even if those are used in multiple files/modules. But it just have a problem: it only work if you write in it's coding style.

6
  • Closure compilng is not obfuscating code :P May 18, 2015 at 5:15
  • 1
    It's not made for it, but works well doing it: it doesn't add extra code like some compilers ( which usually can be reversed which the tools I cited ) but changes it to uncommon ways, some even hard to undo, and remove unused code, which in comparison to real obfuscation is good for performance. May 18, 2015 at 10:28
  • 1
    Not a good idea. Minifying/compiling code server-side might may introduce security issues if the minifier has a bug: zyan.scripts.mit.edu/blog/backdooring-js
    – mgol
    Aug 24, 2015 at 17:13
  • The bug you cited applies only to UglifyJS: it don't apply to Closure Compiler. Aug 29, 2015 at 14:26
  • For all those who care about minifying javascript files, there is also a javascript un-minifier. so I don,t think that is a layer of security at all Oct 17, 2018 at 0:35
5

I would suggest first minify with something like YUI Compressor, and then convert all string and numbers to HEX Values using something like http://www.javascriptobfuscator.com/

With this, the code would be rendered near impossible to understand and I think at this Stage it will take more time for a Hacker to re-enact your code than actually if he re-wrote from scratch. Rewriting and Cloning is what you cant actually stop. After all we are free-people !

5

Try this tool Javascript Obfuscator

I used it on my HTML5 game not only it reduced it size from 950KB to 150 but also made the source code unreadable closure compilers and minifiers are reversable I personally dont know how to reverse this obfuscation.

5

Dean Edward's Packer is an excellent obfuscator, though it primarily obfuscates the code, not any string elements you may have within your code.

See: Online Javascript Compression Tool and select Packer (Dean Edwards) from the dropdown

1
4

I'm under the impression that some enterprises (e.g.: JackBe) put encrypted JavaScript code inside *.gif files, rather than JS files, as an additional measure of obfuscation.

0
4

I've been using Jasob for years and it is hands down the best obfuscator out there.
It has an advanced UI but is still intuitive and easy to use.
It will also handle HTML and CSS files.

The best way to use it is to prefix all of your private variables with something like an underscore, then use the sort feature to group them all together and check them off as targets for obfuscation.

Users can still view your source, but it's much more difficult to decipher when your private variables are converted from something like _sUserPreferredNickName to a.

The engine will automatically tally up the number of targeted variables and prioritize them to get the maximum compression.

I don't work for Jasob and I get nothing out of promoting them, just offering some friendly advice.
The downside is that it's not free and is a little pricey, but still worth it when stacked against alternatives - the 'free' options don't even come close.

1
  • Jason appears to be more of a minifier than an obfuscator. Am I missing something?
    – Alan McBee
    Aug 19, 2013 at 23:03
4

Have you tried Bananascript? It produces highly compressed and completely unreadable code.

1
  • 21
    it compresses the code nicely, but just change the eval() in the last line to console.log() and your console will spit out the whole thing
    – LobsterMan
    Mar 20, 2013 at 18:48
4

I am using Closure-Compiler utility for the java-script obfuscation. It minifies the code and has more options for obfuscation. This utility is available at Google code at below URL:
Closure Tools

But now a days I am hearing much of UglifyJS. You can find various comparison between Closure Compiler and UglifyJS in which Uglify seems to be a winner.
UglifyJS: A Fast New JavaScript Compressor For Node.js That’s On Par With Closure

Soon I would give chance to UglifyJS.

2
3

As a JavaScript/HTML/CSS obfuscator/compressor you can also try Patu Digua.

2

You definitely should consider taking a look at Obfuscriptor.

I goes beyond the typical Javascript minifying tricks we've seen from other tools such as YUI Compressor or Google Closure.

The obfuscated code looks more like encrypted. Unlike anything I've seen before.

4
  • 1
    Thanks for the link! Just tried obfuscriptor and code encrypted indeed (with no key???). And compressed my script from 211 to 36 Kb!
    – user411103
    Mar 25, 2012 at 21:41
  • Note that Obfuscriptor alerts you that it doesn't work with IE. That's a deal breaker for some.
    – Alan McBee
    Aug 19, 2013 at 22:42
  • 2
    The link on the answer doens't point to the tool anymore. I couln't find another live reference to it. Feb 1, 2016 at 9:47
  • 1
    the first link is dead. "Obfuscriptor" May 17, 2017 at 14:46
2

I've used this in the past, and it does a good job. It's not free, but you should definitely take a look.
JavaScript Obfuscator & Encoder

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.