JS Obfuscator CLI

A JavaScript obfuscation CLI tool built on javascript-obfuscator. Each run produces different results using random seeds.

Installation

npm install -g js-obfuscator-cli

Or use directly with npx:

npx js-obfuscator-cli --input app.js

Usage

js-obfuscator --input <file> [options]

Basic Examples

Obfuscate a single file:

js-obfuscator -i app.js -o app-obfuscated.js

Use with npx without installing:

npx js-obfuscator-cli -i app.js

Options

| Option | Type | Default | Description | |--------|------|---------|-------------| | -i, --input | string | (required) | Input JS file path | | -o, --output | string | <input>-obfuscated.js | Output file path | | --seed | number | auto-generated | Random seed (different result each run) | | --compact | boolean | true | Compact single-line output | | --control-flow-flattening | boolean | false | Enable control flow flattening (increases size, reduces performance) | | --dead-code | boolean | true | Enable dead code injection | | --dead-code-threshold | number | 0.1 | Dead code injection probability (0-1) | | --string-array | boolean | true | Enable string array obfuscation | | --string-array-encoding | string | base64 | String encoding: base64, rc4, none | | --string-array-threshold | number | 0.4 | String extraction ratio (0-1) | | --identifier-names | string | mangled | Naming style: mangled, hexadecimal | | --prefix | string | _0x | Identifier prefix | | --self-defending | boolean | false | Self-defending (code breaks when beautified) | | --disable-console | boolean | false | Remove console output | | --rename-properties | boolean | false | Rename property names (may break dynamic access) | | --unicode-escape | boolean | false | Enable unicode escape sequences | | -h, --help | | | Show help |

Advanced Examples

High intensity obfuscation:

js-obfuscator -i app.js -o app-protected.js --control-flow-flattening --self-defending --string-array-threshold 0.8

Deterministic output (same seed = same result):

js-obfuscator -i app.js --seed 12345

Lightweight obfuscation (smaller output):

js-obfuscator -i app.js --dead-code false --string-array-threshold 0.2

Key Features

Random Seed

Each run generates a new random seed, producing different obfuscated output even from the same input file.

String Obfuscation

String literals are extracted into a shuffled, base64-encoded array and accessed by index at runtime.

Identifier Mangling

Variable and function names are renamed to short _0x-prefixed identifiers.

Dead Code Injection

Unreachable code branches are injected to interfere with reverse engineering tools.

Safe Defaults

• Global variables are NOT renamed — module systems work correctly
• Property names are NOT renamed — dynamic access works correctly
• Console output is preserved
• require/import statements are left intact

Compatibility

• Node.js >= 18.0.0
• Target: browser environment
• Fully compatible with CommonJS and ES module systems

License

MIT