Turn readable Python into obfuscated source that still runs. Do a single file right here in your browser, or batch-obfuscate an entire project offline with the desktop app.
Online processing sends your source to our server. Prefer to keep code on your machine? Use the desktop app or CLI.
Conservative defaults keep public names and docstrings intact.
__doc__
def
__all__
test*
The desktop app points at a folder and obfuscates every .py in a single pass — mirror the tree to an output folder, write name.obf.py beside each file, or overwrite in place. Script the exact same run in your pipeline with the bundled pyobf CLI. Everything runs locally — your source never leaves your machine.
.py
name.obf.py
pyobf
Conservative defaults preserve public names and docstrings. Regression tests check runtime behavior; options that change public interfaces or metadata are off by default.
The online tool processes your source on the server and returns the result without saving your code. For local processing, use the desktop app or CLI.
A purpose-built Python tokenizer understands indentation, f-strings, t-strings, decorators, match/case, walrus, and async — not fragile regexes.
match
case
Obfuscation makes source harder to follow by changing names, removing explanatory text and encoding literals. The engine uses a Python tokenizer and scope analysis to apply the transforms you select:
Python ships as source, and even compiled .pyc files or PyInstaller executables can be turned back into readable code in minutes. A Python obfuscator is the simplest protection layer: the output is still plain Python that runs on any interpreter, with no build step or runtime to install, but the names, comments and literals that explain your logic are gone. Teams use it to protect scripts and plugins they hand to customers, code bundled into desktop apps, and tools deployed to machines they don’t control. For a step-by-step walkthrough, see how to obfuscate Python code; to compare approaches, see Nuitka vs Cython vs PyArmor vs obfuscation.
.pyc
Note: Obfuscation raises the effort required to read your code; it is not encryption. Anyone who can run your Python can, with enough work, recover behavior. Combine obfuscation with server-side secrets and proper licensing for anything sensitive.
Strip comments, docstrings and spacing to make Python smaller without changing what it does.
Move URLs, messages and names into an encrypted table so they aren’t readable in the file.
What an analyst can and can’t recover from each technique, answered honestly.
Environment variables, .env, keyring, a server-side proxy, and what obfuscation really hides.
.env
Settings tested against real Flask, Django, FastAPI, Click, Typer and pytest code.
Protect a paid add-on while Blender still lists, installs and registers it.
A step-by-step guide: one file online, a whole project offline, then test and ship safely.
How source obfuscation compares with PyArmor, Nuitka and Cython, and when to use each.
Obfuscate every .py in a project offline, and script the same run in CI.
Six methods, from obfuscation to compiling and server-side code, and what each one actually stops.
The five kinds of protection tools and a five-question checklist for choosing one.
Protect the code inside your .exe, including the hidden-import fix.
.exe
Compilers, bytecode protection and obfuscation compared side by side.
With the default transforms, yes. Renaming is scope-aware and conservative: it only touches names proven to be function-local and rewrites them consistently. Every engine change is tested: the whole Python standard library must still compile after obfuscation, and a test corpus plus real Flask, Django, FastAPI, Click and pytest programs must behave identically. Options that carry a caveat (rename global functions, remove docstrings) are off by default and labeled.
No. The online tool is stateless: your source is obfuscated in the request and the result is returned — never persisted, logged, or shared. Closing the tab discards everything. For code that must never leave your machine, use the desktop app or CLI.
F-string and t-string interpolations are protected — any name used inside {…} is preserved everywhere. Fully dynamic access (looking up a variable by string via eval, exec, or locals()) is not rewritten, so avoid renaming names you reach that way.
{…}
eval
exec
locals()
No. Obfuscation increases the cost of reading and reverse-engineering your code; it does not make it secret from someone who can execute it. Use it as one layer alongside server-side secrets and licensing.
Obfuscate a single file online in seconds, or run the whole project offline with the desktop app and pyobf CLI on a paid plan. The online tool needs no account and stores nothing.
