Possible Duplicate:
How can I obfuscate JavaScript?
Hello!
Is it possible to hide JS code? How? I read somewhere a technique like: take JS to external file, and use js-encrypt.
I know that is impossible to hide from all eyes, but...
Thank you.
Asked
Active
Viewed 7.6k times
20
-
7What's so secret about your JS code? – ceejayoz Feb 08 '10 at 14:54
-
35@ceejayoz what's so secret about any code? Kind of a naive question. There are plenty of good reasons for wanting to hide code. – Bjorn Feb 08 '10 at 14:56
-
1please don't tell me you're hiding passwords or any other sensitive data in javascript. :D – Gordon Gustafson Feb 08 '10 at 14:57
-
no, I don't really see why hiding JS code. You shouldn't do no black magic neither sensitive operations there, so I don't see why hiding it. – Valentin Rocher Feb 08 '10 at 14:58
-
5what if i want to sell JS code? And i have several demo code on my site? (i dont want...just an example..) – Feb 08 '10 at 15:03
-
11@apphacker In my experience, the vast majority of people asking about how to protect CSS/HTML/JS code (or disabling right-click on images) are those not at risk of having their code "stolen". – ceejayoz Feb 08 '10 at 15:38
-
http://stackoverflow.com/a/17468822/2450730 – cocco Jul 04 '13 at 12:44
-
Use Encode.js : encodejs.devincity.com – nachshon f Apr 21 '16 at 15:47
4 Answers
12
It is not possible to hide Javascript from the user, since their browser needs to download it to execute it. The only other option is obfuscation.
Dead account
- 19,587
- 13
- 52
- 82
-
3I agree; security through obscurity isn't very good security at all... – Gordon Gustafson Feb 08 '10 at 14:56
-
-
9@chris-l reminds me of a quote from information security class: "Securtity is not hiding the door. It's putting the door in front of them, telling them how it's locked, and they STILL can't get in." – Cruncher Jan 15 '14 at 20:28
-
8
You can run your private JavaScript server side e.g. using ASP JScript.NET
<% WebService Language="JScript" Class="MyClass" %>
You can put the hidden functionality on the server and call it via AJAX in the non hidden part of the code on the client.
you can also use
<script runat="server">
or if you're not using a Microsoft platform you might consider Mozilla Rhino
acheo
- 3,106
- 2
- 32
- 57
-
Seems like a flippant response but it's the only solution to hiding code. – nicerobot Feb 08 '10 at 15:18
-
2I guess the more modern answer would be to use node.js + socket.io for this kind of thing. – acheo Dec 14 '13 at 07:44
-
Or if not using a server-side platform that supports JS just use whatever server-side language is supported. Assuming that the code to be hidden is something that can be done on the server at all, for example you can't move a game's event handlers to server-side. – nnnnnn Jan 02 '15 at 12:43
-
-
1
As you can take someone else's code and try to encrypt it, same goes for others who can take your code. The only solution that i think is to obfuscate your javascript code so that it becomes little difficult for others to grasp but there again there decryptors available so no real solution as of what i know has come about so far.
0
The simple answer is no - since the browser needs to understand the javascript, then the user will be able to understand the javascript...
rATRIJS
- 309
- 1
- 5