Paste code, pick a preset, and obfuscate. Use Standard for quick protection, Balanced for more coverage, and Maximum when the code matters most. The engine is verified daily against 60+ real-world libraries, and JSO AI can suggest the right preset and pre-check compatibility before you protect. Move into the desktop app for batch work and larger projects.
Generating output is the first check, not a compatibility guarantee.
Follow the compatibility checklist. Choose a paid plan only when its capacity or features match your release needs.
Paste or upload a representative sample, generate output, and check it in your application. For a larger test, review desktop or CLI limits and plan requirements.
Browser-safe formatting and naming controls.
Premium feature preview. Limited to 32 KB samples on this page.
Desktop-only transforms remain visible here so you can compare the full option set before moving into the full app.
Regex per line. Names matching any pattern are kept.
Use one pattern per line for public APIs, framework hooks, or names that should stay stable across builds.
Next, verify behavior in your application.
.js
.js/.jsx
Yes, the online tool is free and needs no account to try. It is a demo of the protection engine rather than a production pipeline, so it carries deliberate limits: uploads are capped at 16 KB, pasted samples at 32 KB, and the endpoint is rate limited. Options that need additional values or desktop-only processing are not applied to the preview. For larger evaluations, use the desktop app or npm CLI after checking that workflow's request limits, rate limits and plan requirements.
It is sent to the hosted service, used to generate your protected result, and the temporary upload file is removed after completion. If you would rather not send source anywhere, the local paths exist for that reason: WinUI Local Standard protects basic ES5 JavaScript entirely offline, and paid Local Advanced keeps modern JavaScript and mixed HTML or server-script source on your own device after an online entitlement check. The security processing documentation describes each path in detail.
Almost always the 32 KB sample cap or an option the preview does not run. The online demo protects up to 32 KB of source and skips options that require additional configuration values or desktop-only processing, so a large file or an advanced preset will not reflect what a real build produces. Run the same input through the desktop app or the CLI to see the full result.
It can be analysed, and no client-side protection changes that, because the browser has to execute the code you sent it. What protection changes is cost. Automated formatters restore whitespace and structure but cannot restore the names, string layout and control flow that were rewritten, so the work of understanding a protected bundle well enough to fork and maintain it is substantially larger than reading a minified one. Treat it as raising cost, not as a boundary.
It can, so test the protected output before release. Preserve names used by external code, and verify framework callbacks, dynamic imports, browser policies and other integrations. Excluding names alone does not guarantee compatibility.
It removes the demo limits and adds the workflows a real release needs: whole folders rather than a single snippet, mixed HTML and server-script files where the script is protected in place and the surrounding markup is left untouched, local processing that keeps source on your machine, and protection reports written locally for later symbolication. The npm CLI covers the same ground for Node-based builds and CI.
