JS obfuscator
Lightly obfuscate JavaScript to make it harder to read.
This is a simple obfuscation that makes code harder to read at a glance. It is reversible, so it is not sufficient for security or license protection. It uses eval, so it may not run in environments with a strict CSP.
Sometimes you want a snippet in a page to not be immediately readable - a small tracking helper, an email address you would rather bots did not scrape, a demo you do not want copied at a glance.
This tool takes JavaScript and re-encodes it so the source is no longer plain text, wrapping the encoded string in a call that decodes and runs it. It is worth being clear up front about what that does and does not achieve: this makes code inconvenient to read, not secure.
How it works
Choosing a method
The Method dropdown offers two encodings, and both produce code that still runs the same way.
| Method | What the output looks like | Notes |
|---|---|---|
| Base64 + eval | Your code becomes one Base64 string, decoded at runtime before it executes | Shortest output; the string is obviously Base64 to anyone who recognises the character set |
| Hex escape + eval | Each character becomes a \xNN escape sequence inside a string literal | Longer output, but looks less like a recognisable encoding at a glance |
How it works
Paste your JavaScript into the input, choose a method, and press Obfuscate. The tool converts the entire source into a single encoded string and emits a small wrapper that decodes the string and passes the result to eval. When the browser reaches that line it reconstructs your original code character for character and runs it. Copy puts the result on your clipboard.
Because the transformation is a plain encoding rather than a rewrite, nothing about your logic changes - the same functions, the same globals, the same behaviour.
What this does not do
It is reversible, and easily so. Anyone can paste the encoded string into a decoder, or simply replace eval with console.log and read the original in the browser console. Treat it as a speed bump, not a lock. Never put API keys, passwords or licence checks in client-side JavaScript and assume obfuscation protects them - anything the browser can run, the user can read.
The output also relies on eval, which has practical consequences. A page with a strict Content Security Policy that omits unsafe-eval will refuse to run it. Some ad networks, extension stores and security scanners flag eval on encoded strings as suspicious, because that is exactly what malicious scripts look like. If your goal is smaller files rather than unreadable ones, a minifier is the better tool.
Terms explained
- Obfuscation
- Transforming code so it is hard for a person to read, while leaving its behaviour unchanged. Distinct from encryption, which requires a key to reverse.
- Base64
- An encoding that represents arbitrary data using 64 ASCII characters. It is an encoding, not a cipher - anyone can decode it without a secret.
- Hex escape
- Writing a character inside a string as \xNN, where NN is its hexadecimal code. JavaScript resolves these back to the original characters when the string is parsed.
- eval
- A JavaScript function that executes a string as code. It is what lets the encoded text run, and also why strict security policies often block this output.
- CSP (Content Security Policy)
- A browser security header that restricts what a page may execute. Without the unsafe-eval directive, eval is blocked and obfuscated output will not run.
- Minification
- Shrinking code by removing comments and whitespace and shortening names. Side effect: harder to read - but the goal is file size, not concealment.
Frequently asked questions
Does obfuscating my JavaScript actually protect it?
No. Obfuscation only slows down casual reading. The browser has to decode the script in order to run it, so anyone can recover the original by decoding the string or logging it instead of evaluating it. Anything that genuinely needs protecting - keys, licence logic, business rules - belongs on a server, not in client-side code.
Will the obfuscated code run exactly the same?
Yes, in normal circumstances, because the transformation is an encoding rather than a rewrite. The one common failure is a strict Content Security Policy: if the page does not allow unsafe-eval, the wrapper is blocked and nothing runs. Test the output on the actual page rather than only in a console.
What is the difference between the two methods?
Base64 packs the whole script into a single compact string, while hex escape expands every character into a \xNN sequence, producing longer but less obviously encoded output. Neither is more secure than the other - both are trivially reversible, so pick based on how the output looks and how long it is.
Can I get my original code back from the obfuscated version?
Yes. Decode the Base64 string with any decoder, or for the hex version let JavaScript parse the string and print it instead of evaluating it. This is a good reason to keep your original source safe - and a reminder that anyone else can do the same.
Why is my antivirus or ad network complaining about the output?
Encoded strings passed to eval are a common pattern in malicious scripts, so automated scanners often flag them regardless of intent. If a scanner, store review or ad network rejects your page, the practical fix is to ship normal or minified code instead of obfuscated code.
Tell us what went wrong and we'll fix it fast. (Leave an email if you'd like a reply.)