What is the best javascript obfuscator?

Question

I am looking to use a javascript obfuscator. What are some of the most popular and what impact do they have on performance?

Answer 1

Yahoo has a pretty good one. It's technically a minifier, but it does a nice job of obfuscating in the process.

YUI Compressor

Answer 2

Tested 8 different obfuscators (except www.javascriptobfuscator.com), and was amazed by how much they all suck. Ended up writing my own obfuscator using regular expressions. Enjoy:

static Dictionary<string, string> names = new Dictionary<string, string>();
static bool testing = false;
static string[] files1 = 
    @"a.js,b.js,c.js"
    .Split(new string[] { Environment.NewLine, " ", "\t", "," }, StringSplitOptions.RemoveEmptyEntries);
static string[] ignore_names = 
    @"sin,cos,order,min,max,join,round,pow,abs,PI,floor,random,index,http,
    __defineGetter__,__defineSetter__,indexOf,isPrototypeOf,length,clone,toString,split,clear,erase
    RECT,SIZE,Vect,VectInt,vectint,vect,int,double,canvasElement,text1,text2,text3,textSizeTester,target,Number
    number,TimeStep,images,solid,white,default,cursive,fantasy,".
  Split(new string[] { Environment.NewLine, " ", "\t", "," }, StringSplitOptions.RemoveEmptyEntries);
string[] extra_names = @"a,b,c".Split(new string[] { Environment.NewLine, " ", "\t", "," }, StringSplitOptions.RemoveEmptyEntries);
string src = @"C:\temp";
string dest1 = src + "\\all1.js";
string dest2 = src + "\\all2.js";

static void Main()
{
  File.Delete(dest1);
  File.Delete(dest2);
  foreach (string s in files1)
    File.AppendAllText(dest1, File.ReadAllText(src + "\\" + s) + Environment.NewLine + Environment.NewLine + Environment.NewLine + Environment.NewLine + Environment.NewLine + Environment.NewLine, Encoding.UTF8);

  string all = File.ReadAllText(dest1);
  int free_index = 0;

  foreach (string s in extra_names)
  {
    free_index++;
    string free_name = "" + (char)('A' + (free_index % 25)) + (char)('A' + ((free_index / 25) % 25));
    Debug.Assert(free_name != "AA");
    names.Add(s, free_name);
  }

  Regex reg1 = new Regex("(var |function |\\.prototype\\.)([a-zA-Z0-9_]+)");

  int startat = 0;
  while (startat < all.Length)
  {
    Match match = reg1.Match(all, startat);
    if (!match.Success)
      break;

    string key = all.Substring(match.Groups[2].Index, match.Groups[2].Length);
    if (!ignore_names.Contains(key))
    {
      free_index++;
      string free_name = "" + (char)('A' + (free_index % 25)) + (char)('A' + ((free_index / 25) % 25));
      Debug.Assert(free_name != "AA");
      if (!names.ContainsKey(key))
        names.Add(key, testing ? key + free_name : free_name);
    }
    startat = match.Groups[0].Index + match.Groups[0].Length;
  }

  Regex reg2 = new Regex(@"/\*.*\*/", RegexOptions.Multiline);
  Regex reg3 = new Regex("([^:\\\\])//.*\r\n");
  Regex reg4 = new Regex("([a-zA-Z0-9_]+)");
  Regex reg5 = new Regex("(\r\n)*[ \t]+");
  Regex reg6 = new Regex("(\r\n)+");
  all = reg2.Replace(all, eval2);
  all = reg3.Replace(all, eval3);
  all = reg4.Replace(all, eval4);
  all = reg5.Replace(all, eval5);
  all = reg6.Replace(all, eval6);
  File.WriteAllText(dest2, all);
}

public static string eval4(Match match)
{
  return names.ContainsKey(match.Groups[1].Value) ? names[match.Groups[1].Value] : match.Groups[0].Value;
}
public static string eval5(Match match)
{
  return string.IsNullOrEmpty(match.Groups[1].Value) ? " " : Environment.NewLine;
}
public static string eval6(Match match)
{
  return Environment.NewLine;
}
public static string eval2(Match match)
{
  return " ";
}
public static string eval3(Match match)
{
  return match.Groups[1].Value + Environment.NewLine;
}

Answer 3

Well, google brought up this as the first link:

http://www.javascriptobfuscator.com

But I wonder what good obfuscation of javascript does. Whatever it is you're doing in javascript that needs obfuscation should probably be done server-side anyway, right?

Answer 4

I've never used obfuscator in production, but I've tested JavaScript Utility and it seems pretty good.

As for the performance, obfuscated code must be unpacked on the fly each time the page is loaded. Might not be a problem for small scripts, but the unpacking time will be significant with bigger files. On the other hand, minified code is directly executable by the browser.

Some obfuscators might produce output that does not run in older or less common browsers. You should test very carefully with the browsers you plan to support.

Answer 5

You could also try the JavaScript Compressor written by Dean Edwards.

Answer 6

I'd have to say Hackvertor (disclaimed I wrote it) it's free and it supports tag based conversion. Check out the example:-

http://www.businessinfo.co.uk/labs/hackvertor/hackvertor.php#PEBoYXNlZ2F3YV83KCKqwMHCw8TGyMnKy8zNzs%2FQ0dLT1NXW2Nna29zd3t%2Fg4eLj5OXm5%2Bjp6uvs7e7v8PHy8%2FT19vj5%2Bvv8%2Ff4kXyIpPmFsZXJ0KCJJJ2Qgc2F5IEhhY2t2ZXJ0b3IiKTxAL2hhc2VnYXdhXzc%2B

Answer 7

Packer with base62

http://dean.edwards.name/packer/
https://github.com/jcoglan/packr <= ruby version