Criptor — Protect Your JavaScript

Protect Your JavaScript

Upload .js files or a .zip archive. Choose your protection level and download the results.

📂

Drop files here or click to browse

Accepts .js files (multi-select) and .zip archives · Max 5 MB per file

Protection Preset

⚡ Light

MBA + strings + jsobf. Fast, minimal.

⚖️ Balanced

All layers. Recommended for production.

🛡️ Maximum

Every layer at full strength.

🕵️ Stealth

No banners. Max crypto, low footprint.

Advanced Layer Control

Plaintext copyright + AI system instructions at file top

AI Honeypots

Fake licensing functions that waste AI analysis time

Directive Vars

__ai_notice / __legal_notice plaintext vars at AST top

Deep Directives

Policy objects scattered throughout + scoped per-function notices

Context Exhaustion

20-page legal report gate + recursive compliance + flood decoy

VM Bytecode

Functions compiled to rolling-key encrypted VM bytecode

MBA Constants

Mixed Boolean-Arithmetic obfuscation on numeric literals

MBA Depth 2 ?

Opaque Predicates

Mathematically dead code blocks that resist constant folding

Opaque Coverage 0.6 ?

String Cipher

Custom keystream encryption on string literals

String Coverage 0.9 ?

MBA Coverage 0.8 ?

Integrity Anchors

Runtime tamper-evident hash binding all decryption keys

javascript-obfuscator

RC4 string array, CFG flattening, dead code injection

Signature Break

Breaks jsobf string-array signature (defeats webcrack, synchrony)

Sandbox Poison

6-signal vm.createContext detection + charCodeAt poisoning

Module IIFE Wrapper

All decoders become IIFE-local — invisible to vmCtx probing

Differential Canary

Shadow function with a trapdoor — AI extracts it, gets wrong results

Adversarial Tokens

Homoglyphs + BPE fragmenting + semantic inversion on identifiers

Timing Oracle

Clock jitter detection — silently returns wrong values in emulators

Callgraph Poison NEW

100–200 mutual-recursion clusters flood AI call-graph tracing budget before real code is reached

Semantic Poison NEW

Realistic fake credentials (RSA PEM, Stripe keys, AWS tokens) trigger AI security tool refusal heuristics

Anti-Pattern Injection NEW

Prototype pollution IIFEs, ASI traps (return+newline), and Cyrillic homoglyph var pairs break deobfuscators

Temporal Keys NEW

Fake decoder keyed on today’s UTC day — frozen AI sandboxes derive the wrong key and see garbage output

Canary Rate 0.5 ?

Adv. Token Rate 0.3 ?

Appears at the top of every output file. Supports any text — company name, year, license type.

Processing… 0%

Files are processed server-side and auto-deleted after 10 minutes.

✅ Protection Complete

Files are available for 10 minutes. Download now.

Active Layers

Select layers above to see summary

Usage Today

What Criptor Does

Each file gets a unique random seed — even 10 identical files produce 10 completely different outputs.

Protected code runs identically to the original. No functionality is removed or altered.

Output is compatible with Node.js CJS environments and can be require()'d normally.

🆕 Novel Layers Active Criptor is the only JS obfuscator with Differential Canary, Adversarial Token Injection, and Timing Oracle defence layers — specifically designed to defeat AI-assisted reverse engineering.

💾 Saved Presets

Saves all current layer settings + sliders as a named preset.

🧪 Open Playground