CleanorTools
Developer

JavaScript Obfuscator

Details

How to use JavaScript Obfuscator

What the tool does, how to run it, and what to expect from the result.

How to obfuscate JavaScript (and what it is actually worth)

Obfuscation raises the cost of casually reading your code. It renames local variables to meaningless hex names, rewrites string literals so they do not show up in a text search, optionally sprinkles unreachable junk, and strips whitespace. It does not encrypt anything and it does not stop a determined reader, because the browser has to be able to run the result.

Use it for what it is good for: making a snippet on a public page less inviting to copy verbatim, or making a marketing widget less trivially editable. Do not use it as a security control. If the code contains a secret, the secret is already public.

  • Paste your JavaScript into the input.
  • Choose a string encoding: none, hex escapes, or base64 with an injected decoder.
  • Toggle rename local identifiers, insert dead code, and minify whitespace.
  • Copy the result, then run it and test it, because the token-based renamer can break code it cannot fully see.
  • Ship it only for deterrence, never as a substitute for server-side protection.
Tips

Getting a better result out of JavaScript Obfuscator

Specific settings and thresholds, not general advice.

  • Obfuscation is not security. Anything the browser can execute, a reader can execute too: paste the output into DevTools, set a breakpoint, and read the decoded strings from the variables panel. If a value must stay secret, it belongs on a server, behind an authenticated API, not in a bundle.
  • This site also ships a deobfuscator that reverses these exact transforms. That is the honest statement of what light obfuscation is worth: the person you are hiding code from can undo it in one paste.
  • The renamer is token-based, not a real parser, and it renames every occurrence of a declared name across the whole file. If a local variable happens to share a name with an undeclared global you use elsewhere in the same file, both get renamed and the code breaks. Test the output before you ship it.
  • Names that appear inside a template literal, or as an object key, or in object shorthand, are deliberately left alone, because renaming the reference without the key would silently change behaviour. So obfuscation on code that is heavy in template strings barely changes anything.
  • Base64 string encoding injects a visible helper function called _0xdec at the top of the file. It converts every literal into _0xdec('...'), which means one search for that function name tells a reader exactly how to decode everything. Hex escapes are less obvious and equally weak.
Limits

What JavaScript Obfuscator does not do

The honest boundary, so you do not lose time finding it yourself.

  • It is not protection. Every transform here is mechanically reversible.
  • It is a token-based transform, not an AST rewrite. It cannot rename with scope awareness, do control-flow flattening, or handle destructuring parameters.
  • It does not touch object property names, template-literal interpolations, or any global or imported identifier.
  • It is not a minifier. The whitespace option strips formatting but does not tree-shake, mangle properties, or optimize.
At a glance

Who JavaScript Obfuscator is for

A quick way to understand who this helps, what it solves, and where it connects next.

Best fit

Developers lightly obfuscating JavaScript.

Ideal for

Using the javascript obfuscator without installing anything or signing up.

FAQ

Common questions

Short answers for the questions people usually have before trying a utility like this.

Will obfuscation protect my API key or my licence check?

No. Anything shipped to a browser is readable by whoever runs it. A key in obfuscated JavaScript is a key in a slightly annoying wrapper: open DevTools, watch the network request, and there it is in the header. Move the secret behind a server endpoint and authenticate the caller. Obfuscation only deters someone who was not really looking.

Can obfuscation break my code?

Yes, and this is the main risk. The renamer works on tokens, not a parsed syntax tree, so it renames every occurrence of a name it saw declared. If your file declares a local called config and also references a global config from another script, both get rewritten and the global reference stops resolving. Always run the output before you deploy it.

What is the difference between hex and base64 string encoding?

Hex rewrites each literal as escape sequences, so 'hello' becomes '\x68\x65...'. The string is still a plain string, only unreadable at a glance. Base64 replaces the literal with a call to an injected _0xdec() helper that decodes at runtime. Base64 hides the text better from a text search, and it advertises exactly how to decode it.

Is this the same as minification?

No. A minifier such as esbuild or terser shortens names, removes dead code, and produces a smaller, faster bundle as a side effect of being unreadable. This tool deliberately adds dead code and a decoder function, so the output is bigger and slightly slower. Use a real minifier for production and use this only if you genuinely want the source to look hostile.

Why did nothing change when I obfuscated my file?

Most likely because your identifiers are unreachable to a token-based renamer. Names used inside template literals, object keys, object shorthand, imports, exports, and member accesses are all skipped on purpose, since renaming them without a full parse would break the code. Modern code that leans on destructuring and template strings has very little the tool can safely touch.

Recommendations

You Might Also Like

Nearby tools from the catalog that fit the same job or workflow.

BG
UtilityDeveloper

Barcode Generator

Developer

Generate a scannable Code 128 barcode as inline SVG from any text or number. Free, in your browser, nothing is uploaded.

CTI
UtilityDeveloper

Code to Image Converter

Developer

Turn a code snippet into a polished PNG screenshot with window chrome and a gradient background. Free, in your browser, nothing is uploaded.

JD
UtilityDeveloper

JavaScript Deobfuscator

Developer

Decode escape sequences and re-indent obfuscated or minified JavaScript so it is readable again. Free, in your browser, nothing is uploaded.

RT
UtilityDeveloper

Regex Tester

Developer

Test regular expressions with live match highlighting, capture groups, and flags. Free, in your browser, nothing is uploaded.

CEB
UtilityDeveloper

Cron Expression Builder

Developer

Build a cron expression from fields and presets, or paste one to read a plain-English explanation. Free, in your browser, nothing is uploaded.

GBG
UtilityDeveloper

GitHub Badge Generator

Developer

Create shields.io-style status badges with custom label, message, and colors. Free, in your browser, nothing is uploaded.

Cleanor app

Do it all on your device

Cleanor puts these tools in one app: compress and convert images, video, and audio, work with PDFs, and scan text right on your device. Plus free up storage and clear inbox clutter with Email Cleaner. Start with a free trial.

  • iPhone
  • Android
  • Macsoon
  • Windowssoon
Get it on the App StoreGet it on Google PlayAll platforms & pricing