Question 1

What is AfterPack?

Accepted Answer

AfterPack is a post-build JavaScript obfuscator. It takes the bundle your toolchain already produces and rewrites it so that reading or searching it, by a person or a model, costs disproportionate effort. It runs after your bundler, never modifies your source, and draws a new seed on every build, so two builds of the same code come out structurally different.

Question 2

Is AfterPack free?

Accepted Answer

Yes. The local engine is unmetered and unlimited: run it on as much code as you like, with no account and no card. A free account adds 10 MB of Pro builds a month, 2 projects and a dashboard. Paid plans start at $49 a month, raise the monthly Pro allowance and the project count, and unlock per-region directives.

Question 3

Is it open source?

Accepted Answer

The CLI and the framework plugins are open source. The engine is free to use, unlimited, and ships as a binary.

Question 4

Does it run on Cloudflare Workers?

Accepted Answer

Yes, in two ways. AfterPack ships as @afterpack/wasm and runs inside your own Worker, with nothing leaving your account. Pass a Pro key to the same package and the build runs in AfterPack's Workers instead: your bundle is transformed there, each file streams back as it finishes, the isolate is destroyed at the request boundary, and if that call cannot be made the build fails instead of falling back to a local build.

Question 5

How is AfterPack different from minification?

Accepted Answer

Minification shortens names and folds constants. It keeps all of the original logic, which is why a model explains minified code about as easily as formatted code. By default AfterPack encodes string literals and decodes them at runtime; from the medium preset up it also rewrites the logic: control flow is flattened, and expressions are replaced by equivalent forms that no longer resemble the original. AfterPack is not a minifier and does not replace one. Run it after yours.

Question 6

What makes AfterPack different from other obfuscators?

Accepted Answer

Most obfuscators ship a fixed output shape: a string array, a decoder bootstrap, a recognisable switch, a VM interpreter. Public deobfuscators hardcode recognisers for those shapes and strip them automatically. AfterPack does not route your program through a VM, and every build draws a new seed, so names, constants, layout and decoder parameters differ between builds: a patch or a script written against one build does not apply to the next. Protection costs output size, and raising the complexity target costs more.

Question 7

What about VM-based obfuscation?

Accepted Answer

A VM obfuscator compiles your logic to bytecode and ships one interpreter next to it. Instrument that dispatch loop once and every function falls out as opcodes, on every build, because the interpreter does not change. AfterPack does carry a small bytecode interpreter, for integer expressions. The difference is that the whole program is not routed through it, so there is no single dispatch loop every function passes through, and every build draws a new seed, so opcode tables, names and layout differ from build to build. The blog run shows what instrumenting one dispatch loop recovers: an agent read javascript-obfuscator's roughly 1,500-line interpreter, logged from inside it, and returned equivalent source in about ten minutes.

Question 8

Does AfterPack help against AI-assisted analysis?

Accepted Answer

That is the case it was built for. A frontier model reads a fixed output shape about as easily as a parser does. Every AfterPack build draws a new seed, so what a model worked out about one build's names, constants and layout does not carry to the next. It raises the cost of an automated pass and resets that cost every release. An agent that runs the code still gets through one build.

Question 9

Can obfuscated code be reversed?

Accepted Answer

Given enough time, every obfuscator's output can be reversed, AfterPack's included. The defence is economic: recovery has to cost more than the one release it applies to, and the cost resets when you ship the next one. Because the engine is small and fast enough to run inside a Worker, you can reshape the code on a schedule or on every request, so the cost resets far more often than a release cycle. Anything that carries real authority still belongs on your server, where a client cannot reach it.

Question 10

Does AfterPack use eval() or Function()?

Accepted Answer

No. The output does not use eval() or Function(), so it runs under a strict Content Security Policy.

Question 11

Will it break my app?

Accepted Answer

A file the engine cannot obfuscate fails the build and names the file, so a broken bundle never ships silently. The plugin acts on the production build only, and devtools, breakpoints and console.log keep working on the output. If something breaks anyway, that is a bug: report it on GitHub Issues, or ask first on GitHub Discussions.

Question 12

What happens to a secret I shipped by accident?

Accepted Answer

The default preset encodes string literals, so an API key or an email that slipped in is no longer plaintext for a scraper or a secret scanner to lift. Some strings stay readable: directive prologues, typeof comparands, property names the runtime needs and export names. The Protection Map and the playground list them. It is still a secret you shipped, and anyone who runs the code reaches it on the first execution, so rotate it. A leak detector that flags emails and known key patterns in your build is on the roadmap.

Question 13

Does AfterPack see my source code?

Accepted Answer

A local build sends nothing: it runs AfterPack as a native binary on your machine. A Pro cloud build sends your built bundle to a Worker isolate, obfuscates it in memory, and discards it at the request boundary. One artifact is stored, the Protection Map that powers your dashboard, and you can switch it off per project. What is kept, and for how long, is in Privacy.

Question 14

What can I use AfterPack with?

Accepted Answer

Any project whose build emits JavaScript: web apps, SaaS front ends, Electron apps, Node services, serverless functions and npm packages. Browser extensions are the exception: the Chrome Web Store rejects obfuscated code. There are plugins for the common bundlers and frameworks, and the CLI runs over an output directory when there is no plugin.

Question 15

How fast is AfterPack?

Accepted Answer

Fast enough to run on every build, and inside a Worker on every request. On a laptop, the wasm build turns a 185 KB bundle around in under 0.3 seconds at the default light preset, and in about 1.5 seconds at medium.

Question 16

Can two builds come out the same?

Accepted Answer

Yes. Pin the seed to your commit with seed: "git" and the same source produces the same output, for cache hits and audits. Leave it unset and every build draws a new seed.

Question 17

Where do I ask a question or report a bug?

Accepted Answer

Questions and proposals go to GitHub Discussions. Bugs go to GitHub Issues. Paid plans also have email support, described on the SLA page.

1	import { obfuscate } from "@afterpack/wasm";
2
3	export default {
4	async fetch(request) {
5	const source = await request.text();
6	const result = await obfuscate({ path: "app.js", source }, { preset: "hard" });
7	return new Response(result.bytes, {
8	headers: { "content-type": "application/javascript" },
9	});
10	},
11	};

	AfterPack0.1.0	javascript-obfuscator5.6.0	js-confuser2.1.3	JSDefender2.12.0	ByteHide1.0.5	JScrambler
Measured on our harness· September 2026
Build timeReal production bundle, wall-clock	381 ms	4.6 s12× longer	10.6 s28× longer	1.5 s 4.0× longer	3.0 s 7.9× longer	—
Output sizeGzipped, × the minified bundle	4.1×	11.1×	13.9×	1.9× At default, 4/5 run	3.5× Default settings, 5/5 run	—
Strongest preset that runsHeadless CI, 5 samples	extremeTop preset, 5/5	mediumhigh preset hangs in CI, 0/5	highTop preset, 5/5	None 4/5 at default	default All switches on: 0/5	—
From vendor documentation and public record
Price & free tierTo protect a production build	Free, unlimited localPaid from $49/mo	Free, open source$19/mo VM add-on	Free, open source	Quote only	Book a demo	Quote only
Framework pluginsFirst-party, in the build	13 first-party plugins	Community loaders	Node API only	None found	Plugins, vendor-claimed	CLI + API
Runs at the edgeCloudflare Workers, WASM	YesWASM + Workers	Not documented	Not documented	No	No	No
CSP-safe outputNo eval(), no new Function()	YesBy default	Not documented	Not documented	Not documented	Not documented	Not documented
Deobfuscator carry-overBuilt on one build, run on the next	Under 6% carries over^† New opcode table every build	Carries over Fixed shape: webcrack, restringer	Public write-ups Not reproduced by us	Carries over Fixed pipeline, per its own docs	Carries over Fixed shape: webcrack	Carries over Public deobfuscator, fixed prelude

The modern JavaScript obfuscator for the web.Stop shipping source code.
Protect your builds.

AfterPack in under a minute

Minified JavaScript is not protected.

Minified

AfterPack

JavaScript obfuscation use cases.

Protect paywall checks

Hide pricing and gating logic

Protect keys you have to ship

Contain accidentally committed secrets

Stop JavaScript patching tools

Hide early features and experiments

The obfuscator that runs inside your Cloudflare Worker.

Your Worker, your engine

Per request, or per rotation window

Pro is the same call

Build on the AfterPack obfuscator

JavaScript obfuscation in three steps.

Pick your framework

Install

Build as usual

Ship

See what the obfuscator did to your build.

Find out what leaks from your site today.

Example reports

AfterPack vs other JavaScript obfuscators.

AfterPack pricing.

Free

Pro

Enterprise

What's next.

Leak detector

Network transport cloaking

Managed source maps

AfterPack on Workers for Platforms

Frequently asked questions.

Protect what you build.

The modern JavaScript obfuscator for the web.Stop shipping source code.Protect your builds.

Why AfterPack