227

Has anybody used a good obfuscator for PHP? I've tried some but they don't work for very big projects. They can't handle variables that are included in one file and used in another, for instance.

Or do you have any other tricks for stopping the spread of your code?

11
  • 12
    Are you sure you need to?
    – Cheery
    Oct 24, 2008 at 7:32
  • 5
    @StevenA.Lowe: beware of making fun of PHP. :-) Mar 22, 2013 at 19:03
  • TRY: github.com/…
    – user956584
    Apr 14, 2013 at 17:58
  • Why would you want to? Jan 6, 2014 at 15:27
  • 3
    If you think this should not be closed, then vote to re-open.
    – Ira Baxter
    Jun 5, 2016 at 13:58

10 Answers 10

254

You can try PHP protect which is a free PHP obfuscator to obfuscate your PHP code.
It is very nice, easy to use and also free.
EDIT: This service is not live anymore.

As for what others have written here about not using obfuscation because it can be broken etc:
I have only one thing to answer them - don't lock your house door because anyone can pick your lock.
This is exactly the case, obfuscation is not meant to prevent 100% code theft. It only needs to make it a time-consuming task so it will be cheaper to pay the original coder.

9
  • 116
    +1 for pointing out the fact that obfuscation is about making it Harder, not impossible. Sep 27, 2011 at 14:19
  • 3
    take note that encrypting your source code instead of obfuscating it doesn't make it impossible to decrypt either, its just really hard to do so.
    – xorinzor
    Jul 24, 2012 at 19:17
  • 9
    Tried it, but did not like it. It only change variable names, it does not neither remove comments..
    – Stefano
    Sep 13, 2012 at 6:45
  • 1
    @Schwern, Leave your door unlocked then hire Columbo and a really good lawyer, to cover yourself ;) Jan 9, 2013 at 12:00
  • 3
    @David Newcomb - Who wants to pay a really good lawyer when you can just lock the door?
    – azoundria
    Jun 7, 2017 at 20:49
114

People will offer you obfuscators, but no amount of obfuscation can prevent someone from getting at your code. None. If your computer can run it, or in the case of movies and music if it can play it, the user can get at it. Even compiling it to machine code just makes the job a little more difficult. If you use an obfuscator, you are just fooling yourself. Worse, you're also disallowing your users from fixing bugs or making modifications.

Music and movie companies haven't quite come to terms with this yet, they still spend millions on DRM.

In interpreted languages like PHP and Perl it's trivial. Perl used to have lots of code obfuscators, then we realized you can trivially decompile them.

perl -MO=Deparse some_program

PHP has things like DeZender and Show My Code.

My advice? Write a license and get a lawyer. The only other option is to not give out the code and instead run a hosted service.

See also the perlfaq entry on the subject.

23
  • 230
    I mostly agree with you, but the OP asked for a product recommendation, not a lecture on the merits of open source.
    – Eli
    Dec 2, 2008 at 22:50
  • 38
    Has nothing to do with Open Source, which is about mashing up the code not just being able to see it. The reality is that any code or data which runs on a user's machine is ultimately transparent no matter how you compile or obfuscate or encrypt it, full stop. The OP needs to understand that.
    – Schwern
    Dec 7, 2008 at 5:50
  • 7
    @JamShady: Obfuscation does not mean you can't fix bugs or make modifications. If you stupidly obfuscate the source code, throw the original away, and insist on maintaining the obfuscated result, yes, you won't be able to do anything. Good obfuscators insist you retain your code and the mapping to the obufscated result; you can debug/modify your original code, ship obfuscated patches to your customers, and even diagnose his problems by using the map to convert obfuscated complaints back into readable ones. He doesn't have the map, which makes this safe.
    – Ira Baxter
    Jul 3, 2010 at 16:50
  • 38
    Question:How, Answer: You shouldn't = not helpful
    – cmc
    Jul 15, 2011 at 15:30
  • 27
    @cmc I'm confident plenty of people will directly answer the question, so there's no loss with my taking a different tack. Half the point of asking an expert is they know when you're asking the wrong question to solve the real problem. This is an application of the "5 Whys". en.wikipedia.org/wiki/5_Whys The real problem/question is "how do I stop people from being able to read/steal my PHP code". The answer is if you ship the code you can't, but you can waste a whole lot of time and money trying and gain a false sense of security. Wasn't that more helpful than a list of obfuscators?
    – Schwern
    Jul 15, 2011 at 18:48
32

Nothing will be perfect. If you just want something to stop non-programmers then here's a little script I wrote you can use:

<?php
$infile=$_SERVER['argv'][1];
$outfile=$_SERVER['argv'][2];
if (!$infile || !$outfile) {
    die("Usage: php {$_SERVER['argv'][0]} <input file> <output file>\n");
}
echo "Processing $infile to $outfile\n";
$data="ob_end_clean();?>";
$data.=php_strip_whitespace($infile);
// compress data
$data=gzcompress($data,9);
// encode in base64
$data=base64_encode($data);
// generate output text
$out='<?ob_start();$a=\''.$data.'\';eval(gzuncompress(base64_decode($a)));$v=ob_get_contents();ob_end_clean();?>';
// write output text
file_put_contents($outfile,$out);
3
  • 21
    Awesome? Every page comes with the complete solution to getting the source: run "gzuncompress(base64_decode($a))". Yes, this will stop non-programmers. But then the original source code will stop non-programmers, who needs encoding for that? The only person who is going to look at this intending to reverse engineer it is a PHP programmer.
    – Ira Baxter
    Aug 10, 2013 at 14:55
  • 2
    Most of the time non-programmers try by search some strings in source code that they want to change, i am also looking for such a solution that only stop non programmers from change in source code e.g. domain name, database name, users etc. Nov 18, 2015 at 16:24
  • This is a very helpful answer for me. I'm only interested in preventing the user from easily opening my "database.php" in notepad and seeing my database username and password. Dec 16, 2015 at 0:26
21

I'm not sure you can label obfuscation of an interpreted language as pointless (I'm unable to add a comment to Schwern's post, so here goes a new entry).

I think it's a little shortsighted to assume you know all the possible scenarios where someone would like to obfuscate code, and you assume that anyone will actually be willing to go to whatever necessary lengths to view that code once obfuscated. Consider my current scenario:

I work for a consulting company that is developing a large and fairly sophisticated PHP-based site. The project will be hosted on a client's server that is hosting other sites developed by other consultancies. Technically any code we write is owned by the client, so we can't license it. However, any other consultancy (competitor) with access to the server can copy our code without getting permission from the client first. We therefore have a genuine reason for obfuscation - to make the effort required for a competitor to understand our code more than the effort of creating a copy of our work from scratch.

16

See our SD Thicket PHP Obfuscator for an obfuscator that works just fine with arbitrarily large sets of pages. It operates primarily by scrambling identifier names. With modest to large applications, this can make the code extremely difficult to understand, which is the entire purpose.

It doesn't waste any energy on "eval(decode(encodedprogramcode))" schemes, which a lot of PHP "obfuscators" do [these are "encoder"s, not "obfuscator"s], because any clod can find that call and execute the eval-decode himself and get the decoded code.

It uses a language-precise parser to process the PHP; it will tell you if your program is syntactically invalid. More importantly, it knows the whole language precisely; it won't get lost or confused, and it won't break your code (other that what happens if you obfuscate "incorrectly", e.g., fail to identify the public API of the code correctly).

Yes, it obfuscates identifiers identically across pages; if it didn't do that, the result wouldn't work.

7
  • From what I can tell this is an EXE that runs under Windows only? At least the eval is a .exe file... Dec 31, 2014 at 19:24
  • The eval file is a .exe-based installer. The complicated truth is the installed product usually runs from a .cmd script because there's a parallel programming language underneath it, but you'll never see that. It was designed as primarily a Windows product; however, if you install it on Linux with Wine, it will run with .sh scripts that are installed with it as though it were a native Linux tool. If you use the GUI portion (optional, most people want to run it as a script in a production build process), it uses the native Java on Windows, and the native Java on Linux.
    – Ira Baxter
    Dec 31, 2014 at 19:52
  • Is it true that Thicket requires addon to the hosting space? If yes, how does that get installed on a shared hosting? Apr 27, 2016 at 16:05
  • @StephenAdelakun: Thicket requires no changes to the server. Download it and check the documentation.
    – Ira Baxter
    Apr 28, 2016 at 2:21
  • Thicket is $200, and based on their website I see no advantage over a free obscuration program that would be worth this cost. I am an independent software engineer and cannot afford this kind of expenditure. Nov 14, 2018 at 14:45
14

The best I've seen is Zend Guard.

9
  • 2
    The SD PHP Obfuscator is just as good, and costs about 1/5th.
    – Ira Baxter
    Sep 4, 2009 at 4:15
  • 1
    @SalmanPK And the reason for that is supposed to be obvious?
    – Pelle
    May 15, 2012 at 11:40
  • @SalmanPK It requires an addon to the web hosting space. Zend Guard probably does too. Not sure which is the most mainstream. Anyway, problem is that it cuts down your potential audience.
    – James P.
    Aug 9, 2012 at 2:37
  • 1
    SD's PHP Obfuscator converts all to lowercase. That'll be a problem if you're using a framework. Mar 12, 2013 at 5:05
  • 1
    @JamesPoulson: It is unclear if your remark is pointed at the SD PHP obfuscator. Just to be clear, it does not require any addon to the web hosting space.
    – Ira Baxter
    Jun 5, 2016 at 14:03
11

Try this one: http://www.pipsomania.com/best_php_obfuscator.do

Recently I wrote it in Java to obfuscate my PHP projects, because I didnt find any good and compatible ready written on the net, I decided to put it online as saas, so everyone use it free. It does not change variable names between different scripts for maximum compatibility, but is obfuscating them very good, with random logic, every instruction too. Strings... everything. I believe its much better then this buggy codeeclipse, that is by the way written in PHP and very slow :)

12
  • Looks good... but is it secure? I mean, can others decrypt it easily? Jan 21, 2011 at 10:50
  • I can assure you that by this moment NOBODY can de-obfuscate the code obfuscated by this obfuscator.
    – PatlaDJ
    Jan 23, 2011 at 9:56
  • 3
    [citation needed] - homebrew encryption is security through obscurity, which is no security at all. Jul 20, 2011 at 15:50
  • 8
    "I can assure you that by this moment NOBODY can de-obfuscate the code" Even PHP? If PHP can do it so can someone else. Looking as the sample code on your site, somewhere you'll have an eval statment that dumps the code out, change that to an echo and you're code will be displayed.
    – user70568
    Feb 28, 2012 at 15:44
  • 4
    WARNING: This method can be trivially decoded back to the original variable names, see: lombokcyber.com/en/detools/decode-pipsomania
    – Zane
    Nov 22, 2016 at 18:45
3

Thicket™ Obfuscator for PHP

The PHP Obfuscator tool scrambles PHP source code to make it very difficult to understand or reverse-engineer (example). This provides significant protection for source code intellectual property that must be hosted on a website or shipped to a customer. It is a member of SD's family of Source Code Obfuscators.

14
  • TrueBug.com is unreachable. I know I am posting comment after more than 3 years, but can you please help with new url of trueBug, if any? Mar 8, 2016 at 10:51
  • @StephenAdelakun Do you only need TrueBug? Use this: TruBug PHP Obfuscator. Mar 8, 2016 at 11:01
  • Sorry, the link is not working. Or am I missing something? Mar 8, 2016 at 23:02
  • @StephenAdelakun I just checked now, it works. Mar 9, 2016 at 10:18
  • 1
    @StephenAdelakun Why only that? :( That's dead software anyway. There are better and awesome ones now right? Mar 13, 2016 at 22:54
2

Using SourceGuardian is good as it comes with a cool and easy to use GUI.

But be aware:

Pay attention to its -rather funny- licensing terms.

  • You are only allowed to run 1 per machine -so far this is acceptable
  • If you want to run the command line interface on another machine, say your web server, YOU WILL NEED ANOTHER LICENSE (Yes, it's funny and I can hear you laughing too).
5
  • 2
    That seems normal to me! 2 machines = 2 licenses! Usually what people do is encode it all on one machine, then upload it to the other(s). Jan 9, 2013 at 11:56
  • @davidnewcomb you do not seem to get the point. You usually encrypt code on your dev machine before shipping it. In case you need to do it online the command line interface also requires an additional license, which is obviously not right. You tend to put the command line interface on the web server and not on your local box.
    – Herr
    Jan 9, 2013 at 17:41
  • 2
    TL;DR good protection, stupid licensing terms.
    – Herr
    Jan 9, 2013 at 17:42
  • 1
    Should be 1 license per user, not per machine.
    – beppe9000
    Jan 20, 2015 at 15:08
  • @beppe9000 Totally agree!
    – Herr
    Jan 20, 2015 at 21:21
-19

Obfuscation is only adding another layer of potential bugs and security vulnerabilities to your program. Please don't do it.

The kind of people who write obfuscation software usually seem very sketchy and non-skilled anyway.

If your code is "great", crackers will go through great lengths to spread it, regardless of whether or not it is obfuscated. If nobody knows/cares about your code, they probably won't, either.

13
  • 8
    Nonskilled? Based on what evidence? I write them. Check my bio before you go making sweeping generalizations. semanticdesigns.com/Company/People/idbaxter
    – Ira Baxter
    May 11, 2010 at 0:29
  • 5
    @Ira: My statement still holds. Most obfuscated code can be broken within minutes. I specifically meant, most people who do it are unskilled, not all. First thing that came to mind was Ioncube, and surely enough, it had a vulnerability published: osvdb.org/show/osvdb/41708. Then again you could probably partially blame that on PHP's obscure security requirements. May 11, 2010 at 2:16
  • 3
    Obfuscation, if done with a reliable tool, changes nothing about the reliability of a program. Binary compilation is a kind of extreme obfuscation, and yet I'd guess you are confident that Zend's PHP engine is reliable. (Obfuscation or compilation done with bad tools shouldn't count).
    – Ira Baxter
    Oct 2, 2011 at 19:12
  • 1
    anyone with half a brain knows that php is struggling (read "non existant") in the real world enterprise software market becasue it's not obfuscated on the and asp.net is. I am so sick of weak minded evangelists saying anything else. (and yes, that's what willful ignorance is) Open Source has been out too long and been tried and found wanting too often for there to be any other conclusiogn than this: hobby? Open Source. Job? Encrypt. Only fools/idiots/people who live in a bubble/have a rich pater can ever ever ever ever EVER think different.
    – conners
    Mar 17, 2012 at 16:58
  • 3
    That comment is almost incomprehensible to me, but it seems to be implying that it makes no sense to sell open source software or software that builds upon open source software. In case you didn't notice, Java is "enterprise", open source, and just as successful as that .NET thing. my company makes millions of dollars, and we never had to use obfuscation. Ask yourself this: what good is selling software if you can't support/improve it (i.e: you just cracked someone else's software and resold it)? Mar 31, 2012 at 0:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.