18

I am looking to use a javascript obfuscator. What are some of the most popular and what impact do they have on performance?

4
  • 1
    Although the issues raised by Robert Harvey may be more or less true, the answers here provide a list of obfuscators and is very useful. Further, Mr. Harvey implies that this expert site can only answer simplistic questions and expert "opinion" and extended discussion is somehow a negative. Would the question be acceptable if it was "Can I get a list of obsfuscators?" Regards, Dave H.
    – DHorse
    Jul 15, 2013 at 2:24
  • DUPLICATE OF ->>> stackoverflow.com/questions/194397/…
    – T.Todua
    Jun 12, 2014 at 10:05
  • you can use jsobfuscator.byethost7.com May 3, 2016 at 12:31
  • 1
    The best obfuscator you'll ever find is a poor programmer who can't write readable, maintainable code 😂
    – iirekm
    Aug 5, 2021 at 17:12

7 Answers 7

11

Yahoo has a pretty good one. It's technically a minifier, but it does a nice job of obfuscating in the process.

YUI Compressor

4
9

Tested 8 different obfuscators (except www.javascriptobfuscator.com), and was amazed by how much they all suck. Ended up writing my own obfuscator using regular expressions. Enjoy:

static Dictionary<string, string> names = new Dictionary<string, string>();
static bool testing = false;
static string[] files1 = 
    @"a.js,b.js,c.js"
    .Split(new string[] { Environment.NewLine, " ", "\t", "," }, StringSplitOptions.RemoveEmptyEntries);
static string[] ignore_names = 
    @"sin,cos,order,min,max,join,round,pow,abs,PI,floor,random,index,http,
    __defineGetter__,__defineSetter__,indexOf,isPrototypeOf,length,clone,toString,split,clear,erase
    RECT,SIZE,Vect,VectInt,vectint,vect,int,double,canvasElement,text1,text2,text3,textSizeTester,target,Number
    number,TimeStep,images,solid,white,default,cursive,fantasy,".
  Split(new string[] { Environment.NewLine, " ", "\t", "," }, StringSplitOptions.RemoveEmptyEntries);
string[] extra_names = @"a,b,c".Split(new string[] { Environment.NewLine, " ", "\t", "," }, StringSplitOptions.RemoveEmptyEntries);
string src = @"C:\temp";
string dest1 = src + "\\all1.js";
string dest2 = src + "\\all2.js";

static void Main()
{
  File.Delete(dest1);
  File.Delete(dest2);
  foreach (string s in files1)
    File.AppendAllText(dest1, File.ReadAllText(src + "\\" + s) + Environment.NewLine + Environment.NewLine + Environment.NewLine + Environment.NewLine + Environment.NewLine + Environment.NewLine, Encoding.UTF8);

  string all = File.ReadAllText(dest1);
  int free_index = 0;

  foreach (string s in extra_names)
  {
    free_index++;
    string free_name = "" + (char)('A' + (free_index % 25)) + (char)('A' + ((free_index / 25) % 25));
    Debug.Assert(free_name != "AA");
    names.Add(s, free_name);
  }

  Regex reg1 = new Regex("(var |function |\\.prototype\\.)([a-zA-Z0-9_]+)");

  int startat = 0;
  while (startat < all.Length)
  {
    Match match = reg1.Match(all, startat);
    if (!match.Success)
      break;

    string key = all.Substring(match.Groups[2].Index, match.Groups[2].Length);
    if (!ignore_names.Contains(key))
    {
      free_index++;
      string free_name = "" + (char)('A' + (free_index % 25)) + (char)('A' + ((free_index / 25) % 25));
      Debug.Assert(free_name != "AA");
      if (!names.ContainsKey(key))
        names.Add(key, testing ? key + free_name : free_name);
    }
    startat = match.Groups[0].Index + match.Groups[0].Length;
  }

  Regex reg2 = new Regex(@"/\*.*\*/", RegexOptions.Multiline);
  Regex reg3 = new Regex("([^:\\\\])//.*\r\n");
  Regex reg4 = new Regex("([a-zA-Z0-9_]+)");
  Regex reg5 = new Regex("(\r\n)*[ \t]+");
  Regex reg6 = new Regex("(\r\n)+");
  all = reg2.Replace(all, eval2);
  all = reg3.Replace(all, eval3);
  all = reg4.Replace(all, eval4);
  all = reg5.Replace(all, eval5);
  all = reg6.Replace(all, eval6);
  File.WriteAllText(dest2, all);
}

public static string eval4(Match match)
{
  return names.ContainsKey(match.Groups[1].Value) ? names[match.Groups[1].Value] : match.Groups[0].Value;
}
public static string eval5(Match match)
{
  return string.IsNullOrEmpty(match.Groups[1].Value) ? " " : Environment.NewLine;
}
public static string eval6(Match match)
{
  return Environment.NewLine;
}
public static string eval2(Match match)
{
  return " ";
}
public static string eval3(Match match)
{
  return match.Groups[1].Value + Environment.NewLine;
}
6
  • 14
    Why do "they all suck"? What issue does your code solve?
    – frenchie
    Mar 5, 2012 at 1:53
  • 2
    @frenchie Well, for one, paste obfuscated javascript generated with those "sucky" obfuscators in to the JavaScript beautifier at jsbeautifier.org and watch it be un-obfuscated instantly.
    – trusktr
    Apr 13, 2013 at 7:31
  • 1
    @AareP, can you provide some sample transformations?
    – trusktr
    Apr 13, 2013 at 7:32
  • 1
    Not all of them. JScrambler for one is not.
    – Alex
    Apr 9, 2014 at 13:48
  • 2
    This is very cool thanks for sharing. How can I use this? It looks like C++ but it doesn't have the includes.
    – Noitidart
    Dec 26, 2016 at 1:16
5

Well, google brought up this as the first link:

http://www.javascriptobfuscator.com

But I wonder what good obfuscation of javascript does. Whatever it is you're doing in javascript that needs obfuscation should probably be done server-side anyway, right?

2
  • Of all I've seen, this is perhaps the best obfuscator. Although I haven't tried JScrambler. May 23, 2014 at 3:22
  • @AStackOverflowUser JScrambler guys are freaky, they require you to upload your code and in my opinion it's over priced. That said JScrambler has the BEST JS protection
    – vin shaba
    Sep 6, 2020 at 11:36
2

I've never used obfuscator in production, but I've tested JavaScript Utility and it seems pretty good.

As for the performance, obfuscated code must be unpacked on the fly each time the page is loaded. Might not be a problem for small scripts, but the unpacking time will be significant with bigger files. On the other hand, minified code is directly executable by the browser.

Some obfuscators might produce output that does not run in older or less common browsers. You should test very carefully with the browsers you plan to support.

2
  • 1
    Obfuscators don't require any code unpacking. Other schemes for minimizing the code might require that, but obfsucation by itself does not.
    – Ira Baxter
    Sep 7, 2009 at 9:28
  • I agree that I got obfuscation and packing mixed up here. Packing is a common approach to obfuscate JS, but its main purpose is to decrease the size of the script file. Sep 13, 2009 at 8:05
2

You could also try the JavaScript Compressor written by Dean Edwards.

1

I'd have to say Hackvertor (disclaimed I wrote it) it's free and it supports tag based conversion. Check out the example:-

http://www.businessinfo.co.uk/labs/hackvertor/hackvertor.php#PEBoYXNlZ2F3YV83KCKqwMHCw8TGyMnKy8zNzs%2FQ0dLT1NXW2Nna29zd3t%2Fg4eLj5OXm5%2Bjp6uvs7e7v8PHy8%2FT19vj5%2Bvv8%2Ff4kXyIpPmFsZXJ0KCJJJ2Qgc2F5IEhhY2t2ZXJ0b3IiKTxAL2hhc2VnYXdhXzc%2B

1
  • 2
    Does anyone know how to use this? I can't seem to figure it out.
    – Noitidart
    Dec 26, 2016 at 7:15
0

Packer with base62

http://dean.edwards.name/packer/
https://github.com/jcoglan/packr <= ruby version

1
  • 4
    Try pasting obfuscated code generated with this into jsbeautifier.org and see it rewritten like the original.
    – trusktr
    Apr 13, 2013 at 7:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.