ShroudJS

A JavaScript obfuscator. Point it at your files, get protected files out.

It pulls your strings into an encoded table, strips your code, packs it, and wraps the whole thing in layers of self-decoding encryption. What someone opens in devtools is noise they have to unwrap first. Zero dependencies. The output runs exactly like the original.

Install

npm install shroudjs

Use

npx shroudjs src dist              # obfuscate every .js in src/ into dist/
npx shroudjs src dist --rounds 3   # more layers
npx shroudjs app.js -o app.out.js  # a single file

Run with no folders and it uses ./input and ./output by default. Sub-folders keep their paths, and anything that is not .js is left alone. Options: --rounds N sets the number of encryption layers (default 2). --no-strings and --no-strip turn off those passes.

Prefer a global command? npm install -g shroudjs, then run shroudjs anywhere.

Works on

Classic browser scripts, Node CommonJS, and bundled output. It does not run raw ES modules (import / export); bundle those to a classic script first.

How it works

Full write-up, including what it does not protect against: chrisch88.dev/projects/shroudjs

License

MIT, see LICENSE.