JavaScript API

The package exports one runtime function, obfuscate, plus TypeScript types for its options.

Signature

function obfuscate(code: string, options?: ObfuscatorOptions): string

Parameters

Name	Type	Default	Description
`code`	`string`	Required	One JavaScript script or ECMAScript module.
`options`	`ObfuscatorOptions`	`{}`	Output formatting, transform entries, naming configuration, a seed, and verbose logging.

See the complete options reference.

Return value

obfuscate returns a JavaScript source string. The call is synchronous and performs no file I/O. The function does not return an AST or source map. If your build reads and writes files, that logic belongs around the API call.

Supported input

Babel parses the input with sourceType: 'unambiguous', so both scripts and ECMAScript modules are accepted. Compile TypeScript, JSX, decorators, and other syntax extensions to JavaScript before calling obfuscate.

Behavior limits

Transforms do not preserve behavior that depends on any of these details:

Code created from strings with direct eval or Function reading names or scopes changed by a transform.
A with statement changing which variable an identifier resolves to.
The outer alias that sloppy-mode Annex B semantics create for a block-level function declaration.
The error from reading a lexical binding before initialization or assigning to const, including code that catches the error.
The completion value returned by evaluating an entire script or eval. This includes the value of pack’s generated Function call.
A top-level script declaration creating, removing, renaming, or changing a property on globalThis.
Generated text, comments, source locations, identifier and label spellings, transformed function or class names, Function.prototype.toString(), stack text, or engine-generated error wording.
Standard built-ins patched before the obfuscated input runs. Patches made by the input itself remain observable.

Outside these cases, a transform preserves runtime behavior or leaves the site unchanged. dropConsole, dropDebugger, mangleProperties, and pack have additional effects described on their transform pages. Like every configurable transform, they run only through their transforms entry. The API does not generate source maps.

Errors

obfuscate throws in three cases:

Babel cannot parse code.
A transform receives invalid configuration. concealStrings validates cache, cover, and scope. mangleProperties validates its cache (entries must be strings, and outputs must be unique and cannot be __proto__, constructor, or prototype) and its nameGenerator (it must return an available, nonnumeric string). An empty stringGeneratorMode array is also rejected.
transforms.pack is true or an options object for a program that uses export statements. Export syntax cannot exist inside a Function body, so pack refuses it rather than emit output that fails to parse.

Apart from that export case, a transform normally leaves a site unchanged when it cannot handle it. dropConsole and dropDebugger intentionally remove their named effects. Property mangling cannot account for uses outside the input. pack runs the program inside a generated Function; its transform page lists the resulting restrictions. The API does not catch or wrap these errors.

Comment handling

The generator removes every comment, including /*! banners, @license, @preserve, sourceURL, and sourceMappingURL. Keep required license text in a separate artifact or prepend it after obfuscation. Append a new source URL or map directive only when it describes the generated output. Property-mangling annotations are input-only compiler instructions. mangleProperties reads exact standalone @__MANGLE_PROP__, #__MANGLE_PROP__, @__KEY__, and #__KEY__ markers before the generator removes them. A hashbang such as #!/usr/bin/env node remains because Babel represents it as an interpreter directive rather than a comment. JavaScript directive prologues such as "use strict" also remain and keep their runtime semantics.

Exported TypeScript types

Type	Purpose
`ObfuscatorOptions`	The optional second argument to `obfuscate`.
`ConcealStringsOptions`	The object accepted by `transforms.concealStrings`.
`ManglePropertiesOptions`	The object accepted by `transforms.mangleProperties`.
`PackOptions`	The object accepted by `transforms.pack`.
`PropertyNameGenerator`	The `(index: number) => string` callback used by `nameGenerator`.

The package exports these types from its root entry point. You do not need an internal import path.

Example

obfuscate.mjs

import { readFile } from 'node:fs/promises'

import { obfuscate } from 'webfuscator'

const source = await readFile('input.js', 'utf8')
const output = obfuscate(source, {
  minify: true,
  seed: 7,
  transforms: { renameIdentifiers: true },
})

Obfuscator options

Review every top-level option and configurable transform.

Quickstart

Put the API into a file-based build script and run the result.

Get started

Reference

Support

Parameters

Return value

Supported input

Behavior limits

Errors

Comment handling

Exported TypeScript types

Example

Obfuscator options

Quickstart

​Parameters

​Return value

​Supported input

​Behavior limits

​Errors

​Comment handling

​Exported TypeScript types

​Example

Obfuscator options

Quickstart

Parameters

Return value

Supported input

Behavior limits

Errors

Comment handling

Exported TypeScript types

Example