Downloads · desktop project workflow

Download JavaScript Obfuscator

WinUI 3 protects plain ES5 .js offline with Local Standard, or modern .js/.jsx and mixed HTML/server-script files source-locally with Local Advanced after an online paid-plan check — including the protection report, written on-device. VM bytecode protection uses the service.

Download WinUI 3 v3.4.5 Which App Should I Pick? Security Evidence

Obfuscating JavaScript files one by one can be time consuming. The desktop app lets you protect whole projects in just a few clicks.

Choose A Download

Pick the desktop path that matches the job.

The browser tool is best for quick validation. WinUI 3 offers offline basic ES5 .js protection and paid source-local protection for modern .js/.jsx and mixed HTML/server-script files, with the protection report written on-device. Use hosted mode for VM bytecode.

Legacy compatibility

Windows Forms

Smallest download, broadest Windows compatibility, and the fastest way to manage and protect folders through the hosted service.

Review Windows Forms ›

Recommended

WinUI 3

Use WinUI 3 on Windows 10+ for offline ES5, paid source-local modern .js/.jsx, or hosted mixed-file and VM workflows.

Review WinUI 3 ›

Automation

Integration Package

Advanced teams can connect protection to release jobs after the desktop or online workflow proves the settings.

Review integrations ›

Try Online Obfuscator Compare Plans Review Security Evidence

JavaScript Obfuscator for Windows — Windows Forms

Legacy compatibility Most Compatible

Lightweight desktop client for protecting JavaScript projects through the hosted service. It is small, fast to launch, and works on older Windows versions.

Batch processing and embedded JavaScript support
Same protection engine as the modern Windows app
Hosted protection and login traffic use HTTPS
API credentials stay in app memory and are excluded from saved project files
Smaller download (~190 KB)
Requires .NET Framework 4.x (already installed on most Windows)
Runs on Windows 7 SP1 and later (32 or 64-bit)

Using an older Windows Forms build? Copies from before 2026‑07 may be configured to reach the service on the www. host, which now redirects. A redirect cannot carry a SOAP request, so the app reports either a 301 Moved Permanently network error or an incorrect key/password — your credentials are not actually at fault. Fix it without reinstalling by saving this file as javascriptobfuscator.exe.config next to javascriptobfuscator.exe:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <appSettings>
    <add key="ServiceUrl" value="https://javascriptobfuscator.com/JSOService.asmx" />
  </appSettings>
</configuration>

Re-downloading this package also resolves it, and the WinUI 3 app above is unaffected.

Download ›

~190 KB · .zip

JavaScript Obfuscator for Windows — v3.4.5 (WinUI 3)

New Recommended Maximum Protection

Modern Windows app with offline Local Standard for basic ES5 .js, plus source-local Local Advanced for modern .js/.jsx and mixed HTML/server-script files after an online paid-plan check. Optional protection reports (with polymorphism fingerprint) can be enabled when a build needs a .report.json sidecar; they are off by default. Hosted mode remains available for VM bytecode protection. Self-contained — no separate .NET install required. Requires Windows 10 build 17763 (October 2018 Update) or later, 64-bit.

Local Standard: offline, no credentials, basic ES5 .js identifier protection
Local Advanced: source stays on-device (modern .js/.jsx and mixed HTML/server-script files); paid plan/options are checked online before processing; optional protection reports are off by default; VM bytecode is excluded
Command line: cli\jso-local.exe <project.jsoproj> runs the same pipeline from CI — Local Standard needs no credentials; Local Advanced reads JSO_API_KEY / JSO_API_PASSWORD
Hosted Standard / Balanced / Maximum protection presets for modern syntax and advanced options
Plan-labelled presets and advanced options, with one preflight message before any source upload
Hosted Runtime Defense: Debug Protection (anti-debugger), Domain Lock, Date Lock
Clear success messages after protection completes
Self-contained — no .NET install required
Windows 10 build 17763 or later (64-bit)

Download ›

~94 MB · .zip

Advanced Integration Package

Advanced Optional

This package is for teams that want to connect JavaScript Obfuscator to an existing release process. Most end users should download one of the Windows desktop apps above.

Optional advanced download for release automation
Useful when protection must be part of an existing release process
Desktop app remains the recommended download for most users
Choose the tarball for package install or the zip for direct distribution

Docs: Advanced integration guide

Download .tgz › Download .zip

Version 0.3.2 · includes verified examples and release checks

Local Stack-Trace Symbolicator

Zero-dependency Node CLI for demangling protected stack traces and captured Sentry, Bugsnag, Rollbar, Datadog, Honeybadger, Raygun, Airbrake, and AppSignal events. Maps and event data stay on your machine.

Version 0.5.0 · Node 18+ · direct download, not an npm-registry package

Download .tgz › Download .zip

Runtime Defense Event Forwarder

Customer-operated Node collector for Slack, Discord, Splunk HEC, Elasticsearch, and HMAC-signed webhooks. Includes body/header token authentication, token stripping, a 256 KB intake limit, and bounded retries.

Version 0.2.0 · Node 18+ · forwarding software, not staffed monitoring

Download .tgz › Download .zip

Electron Bytecode Adapter

Post-protection adapter for Electron V8 cached data. The Node test suite validates scaffold mode, manifest and header handling, and failure behavior; generate release bytecode under the exact Electron version you ship.

Version 0.1.0 · Node 18+ · direct download, not an npm-registry package

Download .tgz › Download .zip

React Native Runtime Defense Adapter

Mobile guard, Metro integration, and Android/iOS probe templates for root, jailbreak, hooks, emulator, and signing signals. Device-specific behavior must still be validated in your supported app and OS matrix.

Version 0.2.0 · Node 18+ · direct download, not an npm-registry package

Download .tgz › Download .zip

C# Integration Guidance

Use the maintained client contract and keep API credentials in server-side configuration. The retired legacy .NET 2.0 sample is no longer recommended.

Open client guidance ›

Browser API Safety Note

Do not put API credentials in browser JavaScript. Use a server-side integration or the maintained release package instead.

Open maintained integration ›

Verify download integrity

Compare the SHA-256 digest after downloading. The manifest covers every archive linked on this page; a mismatch means the file is incomplete, stale, or not the reviewed artifact.

Download SHA256SUMS.txt

PowerShell: Get-FileHash .\downloaded-file.zip -Algorithm SHA256

Publisher-signing status: the current JSO-owned Windows executables are not Authenticode-signed, so Windows may show Unknown Publisher. The SHA-256 manifest detects changed or incomplete bytes when obtained through this HTTPS site, but it does not authenticate a Windows publisher identity. A future signed build must use a current certificate and retain the same archive/checksum verification path.

Recommended next steps

Use the online obfuscator to test a small sample first.
Download the Windows Forms app if you want the smallest and most compatible desktop version.
Download the modern Windows app if you prefer a newer interface and use Windows 10 or later.
Use the advanced integration downloads only when your team specifically needs them.
For procurement or security review, open the Security Evidence hub to review desktop source handling, runtime monitoring, payment-page evidence, and VM proof paths.
Need a smaller download or want to run on older Windows (7 SP1+)? The Windows Forms build (~190 KB) runs the same core obfuscation engine and requires only .NET Framework 4.x.

Frequently asked questions

Which download do I need?

It depends on whether you want a desktop application or a build-pipeline tool. The Windows desktop applications give you a graphical workflow for protecting files and saving projects, which suits manual releases and inspection. If protection needs to happen in CI, the npm CLI and bundler plugins are the better fit and are installed from the package registry rather than downloaded here.

Do the desktop applications send my source code anywhere?

That depends on which engine path you choose. The local engine runtimes protect on your own machine, so source stays on the device while an entitlement check still happens online. Other paths use the hosted service and upload the selected JavaScript. Decide this deliberately and write it down, because it is the question a security reviewer will ask first.

How do I verify a download is the file you published?

Compare the checksum against the published value before running anything. Every public archive is listed with a checksum for exactly this purpose, and verifying is the difference between trusting the file and trusting the network that delivered it. Signed release verification covers the same ground for artifacts produced by your own protected builds.

Are the desktop applications Windows only?

The graphical applications are Windows desktop software, yes. Cross-platform workflows are covered by the npm CLI and the bundler plugins, which run wherever Node runs, and by the HTTP API for anything that needs to be driven from another language or operating system.

Do I need a paid plan to use these?

The tools install freely and the option set available to a given account depends on its plan. Several transforms and the hosted API are tied to paid tiers, so the practical answer is that you can install and evaluate, and the specific options your builds may use follow your entitlement. Check the plan comparison for which transforms sit at which tier before designing a pipeline around one.

How do I know which version I am running?

The version is shown in the application and recorded in the protection report for every run. Keeping that report matters beyond version tracking, because it is what symbolication needs to translate a stack trace from that build back into real names. Archive one per release rather than per machine.