JavaScript Obfuscator

Protect your source code by making it unreadable

JavaScript Tool

Obfuscation Level

Advanced Protection

Mangle Variable Names

Obfuscated Code

Make your script harder to read at a glance

When you publish JavaScript, anyone can open it in the browser. Obfuscation does not make code secret, but it does raise the effort needed to skim it, copy it or spot where a value is defined. This tool wraps your code in an encoded form that still runs the same way, and it does it with two levels you can choose between.

How to obfuscate a script

Paste your code into Clean Source, or press Load Sample to try a small login check.
Choose an Obfuscation Level: Light (CharCode conversion) or Aggressive (Base64 Eval).
Leave Mangle Variable Names ticked if you want names shortened first, or untick it to keep them.
Click Obfuscate Now, then use Copy on the Obfuscated Code panel.

What the two levels produce

Light converts every character of your script to its numeric code and outputs a single eval(String.fromCharCode(...)) call. It is compact and quick to run.
Aggressive first Base64-encodes the code, wraps it in a decode-and-eval call, then converts that wrapper to character codes inside a function. The result is longer and less readable than the Light output.

With mangling on, the code is minified before encoding and variables declared with var, let or const are renamed to short hex-style names.

Realistic uses

Adding a small barrier to a demo script or freelance deliverable before sending it to a client.
Hiding hard-coded strings such as an internal label from casual view-source browsing.
Creating obfuscated samples to test a deobfuscation or malware-analysis workflow.
Learning how eval-based packers work by comparing input and output.

Be honest about the protection

This is encoding, not encryption. Anyone can decode the output in seconds by replacing eval with console.log, so never rely on it to hide passwords, API keys or licensing logic; the sample script that compares a hard-coded password shows exactly what not to do in production. Because the output uses eval, it can be blocked by a Content Security Policy that forbids unsafe-eval, it runs slightly slower, and it may trigger warnings in antivirus or ad-platform scanners. Output size grows considerably, and Aggressive mode is much larger than Light mode. Encoding runs in your browser.

Related Tools

Frequently Asked Questions

Can obfuscated code be reversed?

Yes. Both levels rely on eval, so anyone can print the decoded string instead of running it. Obfuscation only slows casual reading. Do not treat it as a way to protect secrets such as passwords or API keys.

Which level should I choose?

Light gives smaller output that is a single character-code call. Aggressive adds a Base64 layer and a wrapper function, so it is harder to skim but noticeably larger. For most simple scripts Light is enough.

What does Mangle Variable Names do?

It minifies the code first and renames variables declared with var, let or const to short hex-style names. It is text-based renaming, so test the result, especially if variable names also appear inside strings.

Will the obfuscated script work under a strict Content Security Policy?

Probably not. The output calls eval, which a policy without unsafe-eval will block. If your site enforces such a policy, use a build-time obfuscator that does not rely on eval instead.

Does obfuscation change how the code behaves?

The encoded script should execute the original code unchanged, though it runs through eval and is slightly slower. Enabling variable mangling carries a small risk of altering behavior, so run your tests on the output.