JavaScript VM obfuscation

JavaScript Obfuscator

JSVeil transforms your JavaScript into custom bytecode and a virtual machine that runs it. Make your code harder to understand, reproduce and tamper with.

Try now
(function/* JSVeil */ He(Y,d){const Q=d.Object,ee=d.Array,T=d.Function,fe=d.Reflect,S=d.Error,G=d.TypeError,ae=d.ReferenceError,Bt=d.RegExp,dt=d.BigInt,Ft=d.atob,bt=d.String.fromCharCode,Z=fe.apply,Ut=fe.construct,B=Q.defineProperty,Je=Q.getOwnPropertyDescriptor,F=Q.freeze,E=Math.imul,we=T.prototype.toString,ge=T.call.bind(T.call),Ne=T.call.bind(d.String.prototype.charCodeAt),kt=T.call.bind(ee.prototype.slice),Re=T.call.bind(ee.prototype.push),he=T.call.bind(ee.prototype.pop),qt=T.call.bind(ee.prototype.lastIndexOf),X=T.call.bind(WeakMap.prototype.get),me=T.call.bind(WeakMap.prototype.set);function ye(e){let t=2166136261;for(let n=0;n<e.length;n++)t=E(t^Ne(e,n),16777619);return t>>>0}const ve={},Qe=new WeakMap;let Xe=0;B(ve,"v",{get(){return Xe++,7}}),me(Qe,ve,9);const Ye=ve.v^7|Xe^1|X(Qe,ve)^9|E(2147483647,3)^2147483645,z=ye(Z(we,He,[]))^Ye,Ae=d.atob(Y[0]);let $=Y[1]^z;const Ce=new Uint8Array(Ae.length);for(let e=0;e<Ae.length;e++)$^=$<<13,$^=$>>>17,$^=$<<5,Ce[e]=Ne(Ae,e)^$&255;function Ze(e,t){if(!t)return e;if(t<0||t>134217728)throw new S;const n=new Uint8Array(t);let o=0,r=0;function i(f){if(f===15){let u;do{if(o>=e.length)throw new S;u=e[o++],f+=u}while(u===255)}return f}for(;o<e.length;){const f=e[o++],u=i(f>>>4);if(o+u>e.length||r+u>t)throw new S;if(n.set(e.subarray(o,o+u),r),o+=u,r+=u,o===e.length)break;if(o+2>e.length)throw new S;const c=e[o++]|e[o++]<<8;if(!c||c>r)throw new S;const a=i(f&15)+4;if(r+a>t)throw new S;if(a<=c)n.set(n.subarray(r-c,r-c+a),r),r+=a;else for

Online obfuscator

Input

example.js

Custom Obfuscation Options

0 / 9

Code structure

Use a fixed seed to reproduce the same output.

Rename eligible global identifiers.

Add misleading paths to the control flow.

Runtime restrictions

Allow browser execution only.

Limit execution to selected hostnames.

Debugging & output

Periodically check for open developer tools.

Stop protected code after repeated long pauses.

Suppress messages in the browser console.

Make stepping through code harder.

Built-in obfuscation protection is enabled by default. Enable additional features as needed.

About JSVeil

JSVeil is a JavaScript obfuscator built around virtual-machine obfuscation. It is designed to make your code harder to inspect and reverse engineer, with configurable protections for different projects.

Free version

Free up to 30 KB.

Custom Obfuscation Options

Adjust how your code is obfuscated and where it can run. Each option can be enabled separately.

Custom Seed

The seed controls random choices during obfuscation. Use the same source, options, compiler version and seed to reproduce a result.

When off, the compiler generates a new cryptographically secure random seed for each obfuscation.

Rename Globals

Renames eligible global variables and functions to make the original code structure harder to recognize.

Review references from HTML, other scripts and public APIs before enabling it.

Bogus Control Flow

Adds decoy branches that make the logical execution path harder to follow.

This may increase output size and execution time. It is optional and starts off.

Environment Checks

Restricts execution in automated browsers and non-browser environments such as Node.js and jsdom.

Only browser execution is allowed.

Domain Lock

Allows exact hostnames, multiple hostnames and wildcard subdomains. Internationalized names are converted to their ASCII form.

A wildcard such as *.example.com does not include example.com. Add the parent hostname separately if needed.

DevTools Detection

Checks for open developer tools at regular intervals. The default interval is 1,500 ms.

When triggered, runtime protection takes effect.

VM Timeout Check

When enabled, checks for long pauses while the protected code is running, such as pauses during debugging. By default, each detected pause of at least 15 seconds counts once. After two such pauses, the current VM stops running the protected code.

This counts long pauses, not the total time the code has been running. You can adjust both the pause duration and the number of pauses needed to trigger it.

Disable Console Output

Disables console output when the obfuscated script runs.

Useful when you don’t need logs in production; it also makes troubleshooting harder.

Debug Protection

Periodically triggers debugger statements to interrupt debugging. The default interval is 1,000 ms.

FAQ

What is JSVeil?

JSVeil is a JavaScript obfuscator built around virtual-machine obfuscation. It is designed to make your code harder to inspect and reverse engineer, with configurable protections for different projects.

What is JavaScript VM obfuscation?

JavaScript VM obfuscation converts protected code into custom bytecode and includes a JavaScript virtual machine to execute it. This adds a layer between the source logic and its execution, making the code harder to analyze and reverse engineer.

Do you store my source code?

Never. Your source code is used only to process your current obfuscation request and isn’t retained afterward.

Is JSVeil free?

Yes. You can obfuscate JavaScript files up to 30 KB for free. Feel free to try it with your own code.

Need stronger obfuscation or support for larger files?

Email us at with your requirements, and we’ll help you find a solution tailored to your project.