# AfterPack documentation

A post-build step that obfuscates the JavaScript your bundler produces. One dev dependency, one line; production output ships unreadable, development stays untouched.

Source: https://www.afterpack.dev/docs

> Stop shipping your source code. Every bundle you deploy is your source: a coding agent now reads, explains and rewrites minified JavaScript in minutes, so minified only means published in a smaller font. AfterPack is the post-build step that closes that gap. One dev dependency, one line, and your production output ships as something no reader, human or model, can search, lift or re-derive without paying a cost that starts over on every release. It runs after your bundler, never touches your source, and never breaks your build; every run hands you a Protection Map of exactly what changed. It does not turn a client-side secret into a server-side one, and it says so. What it does is make the code you must ship to the browser expensive to read, and expensive again on every release.

## Use it when
- The browser receives logic someone would pay to copy or bypass: a license check, pricing rules, anti-cheat, a paywall, an embedded SDK.
- A customer or a security questionnaire asks whether the JavaScript you ship is readable.
- You want a build that stays unchanged in development and fails rather than ships weaker output.

## Skip it when
- Everything valuable already runs on the server and the client is a thin view.
- The code is open source or is meant to be read.
- You need a secret to stay secret in the browser: no obfuscator does that, and AfterPack says so.

## Everything in one file
- [Full docs corpus](https://www.afterpack.dev/llms-full.txt): every page below, concatenated.
- [Configuration as JSON](https://www.afterpack.dev/docs-config.json): the registry, machine-readable.
- [Roadmap](https://www.afterpack.dev/roadmap.md): what has shipped and what is next.

## Getting started
- [Overview](https://www.afterpack.dev/docs.md)
- [Quickstart](https://www.afterpack.dev/docs/quickstart.md): Pick your framework, install one dev dependency, build, and open the Protection Map.
- [Best practices](https://www.afterpack.dev/docs/best-practices.md): How to ship obfuscated JavaScript by default, mark the regions that matter with directives, and keep rotating your build so attackers can't get ahead.
- [How AfterPack works](https://www.afterpack.dev/docs/concepts.md): What standard (Free) output does to your code, how it resists reversal, and what an attacker can actually recover.

## Guides
- [Build & CI](https://www.afterpack.dev/docs/builds.md): Where AfterPack sits in your pipeline: production only, build once and promote everywhere, with a CI recipe and the rules for seeds, artifacts, source maps, and a down cloud.
- [Protection Map](https://www.afterpack.dev/docs/protection-map.md): The HTML report that shows what AfterPack did to your code: every token coloured by how hard it is to reverse.

## Use cases
- [Paywall checks](https://www.afterpack.dev/docs/use-cases/paywall-checks.md): A paywall gate in the bundle is a named function returning a boolean, and flipping it is a one-line patch. What obfuscation and a per-build seed change about finding it and keeping the patch working.
- [Pricing & gating logic](https://www.afterpack.dev/docs/use-cases/pricing-logic.md): Plan limits, quota thresholds and feature-flag rules in client JavaScript read as a specification of your commercial model. How to stop them being readable, and what stays observable anyway.
- [Shipped API keys](https://www.afterpack.dev/docs/use-cases/shipped-api-keys.md): Restrict it, proxy it, rotate it, then obfuscate what is left. What encoding a credential in your bundle actually buys, and where it stops.
- [Accidental secrets](https://www.afterpack.dev/docs/use-cases/accidental-secrets.md): A credential reached a deployed bundle. How to find out what your live site exposes right now, what the next build changes for the value, and why rotation is the step that closes it.
- [Patching tools](https://www.afterpack.dev/docs/use-cases/patching-tools.md): A userscript, a Tampermonkey patch or an extension has to anchor on a name, a string or a recognisable shape in your JavaScript. What structural obfuscation and a new build shape do to those anchors.
- [Unreleased features](https://www.afterpack.dev/docs/use-cases/unreleased-features.md): Flag names, route strings and unreleased UI text ship to every visitor before you announce anything, and people diff bundles between releases. What to strip, what to protect, and what to keep out of the build entirely.
- [Security scanners](https://www.afterpack.dev/docs/use-cases/security-scanners.md): Secret-shaped patterns, a sourceMappingURL back to your source, library fingerprints and a plain-or-minified label. What an automated reader checks, and what an obfuscated build changes in the report.
- [Electron license logic](https://www.afterpack.dev/docs/use-cases/electron-license-logic.md): app.asar unpacks with one command, and a local license or trial check is usually one comparison. How to obfuscate main, preload and renderer so a crack does not survive your next release.
- [Browser extensions](https://www.afterpack.dev/docs/use-cases/browser-extensions.md): A published extension is a zip anyone can unpack and read. What obfuscating the background and content scripts changes, and the store policy to check before you ship one.

## Frameworks
- [Frameworks](https://www.afterpack.dev/docs/frameworks.md): Which package to install for your stack, where it hooks, and what it writes.
  - [Angular](https://www.afterpack.dev/docs/frameworks/angular.md): Angular v17+ obfuscation is a postbuild pass over dist/<app>/browser: via the CLI, or the @afterpack/angular helper.
  - [Astro](https://www.afterpack.dev/docs/frameworks/astro.md): @afterpack/astro is a thin integration that wires @afterpack/vite into Astro's own Vite pipeline.
  - [Electron](https://www.afterpack.dev/docs/frameworks/electron.md): @afterpack/electron wires main, preload and renderer with one seed in a single call, and refuses electron-vite's bytecodePlugin and unguarded backups before they can ship your source.
  - [esbuild](https://www.afterpack.dev/docs/frameworks/esbuild.md): @afterpack/esbuild hooks build.onEnd and obfuscates the emitted output in place.
  - [Next.js](https://www.afterpack.dev/docs/frameworks/nextjs.md): @afterpack/next obfuscates the client JavaScript inside next build, on Turbopack or webpack, SSR or static export.
  - [Nuxt](https://www.afterpack.dev/docs/frameworks/nuxt.md): @afterpack/nuxt is a Nuxt 3 module that registers @afterpack/vite on Nuxt's Vite config.
  - [Parcel](https://www.afterpack.dev/docs/frameworks/parcel.md): @afterpack/parcel-optimizer obfuscates each packaged bundle in memory as a Parcel 2 Optimizer, and fails the build closed rather than ship a chunk that 404s in production.
  - [Plain JS](https://www.afterpack.dev/docs/frameworks/plain.md): Point npx afterpack@latest at any directory of emitted JavaScript. No bundler, no plugin, no config file required.
  - [Remix](https://www.afterpack.dev/docs/frameworks/remix.md): There is no @afterpack/remix package. Remix builds through Vite, so use @afterpack/vite, or run the CLI on the build output.
  - [Rollup](https://www.afterpack.dev/docs/frameworks/rollup.md): @afterpack/rollup reads directives from your source and runs the engine in generateBundle, before Rollup writes the output.
  - [Svelte](https://www.afterpack.dev/docs/frameworks/svelte.md): @afterpack/svelte wraps @afterpack/vite for Svelte projects: one plugin line in vite.config.ts.
  - [SvelteKit](https://www.afterpack.dev/docs/frameworks/sveltekit.md): @afterpack/sveltekit: one plugin line after sveltekit() in vite.config.ts.
  - [Vite](https://www.afterpack.dev/docs/frameworks/vite.md): @afterpack/vite obfuscates your build in generateBundle, before Vite writes it. It is the reference integration every other Vite-family package wraps.
  - [Vue](https://www.afterpack.dev/docs/frameworks/vue.md): @afterpack/vue wraps @afterpack/vite for Vue 3 projects: one plugin line in vite.config.ts.
  - [Webpack](https://www.afterpack.dev/docs/frameworks/webpack.md): @afterpack/webpack taps compilation.hooks.processAssets and obfuscates your assets before webpack writes them.

## CLI
- [CLI](https://www.afterpack.dev/docs/cli.md): Invoking npx afterpack@latest: an optional path, every config key as a flag, the verify and audit subcommands, and the full exit-code contract.
- [Audit](https://www.afterpack.dev/docs/audit.md): Scan a live URL for exposed secrets, leaked source maps, weak protection, dangerous patterns and known CVEs. The same scanner that powers the public security scanner, from your terminal.

## Configuration
- [Configuration](https://www.afterpack.dev/docs/config.md): Every option, where to set it, and what it does.
- [Presets](https://www.afterpack.dev/docs/presets.md): The five protection levels from minify to extreme, the three engine parameters each one sets together, and what the zero-config default (light) already guarantees.
- [Complexity](https://www.afterpack.dev/docs/complexity.md): The single dial behind every preset: what rises as the number climbs, the one threshold that flips at medium, and which transformations config can turn off but not force on.
- [Directives](https://www.afterpack.dev/docs/directives.md): Comments in your source that change AfterPack's protection for the code they mark.

## Security
- [Threat model](https://www.afterpack.dev/docs/threat-model.md): The security-review artifact for AfterPack: the asset it defends, the attacker classes it holds against, how a secret survives, where the current scope ends, and the controls it sits alongside.
- [Reversal classes](https://www.afterpack.dev/docs/reversal-classes.md): The static-attacker classes AfterPack's transforms fall into, and what recovering each one gets an attacker.
- [Privacy](https://www.afterpack.dev/docs/privacy.md): A local build sends nothing. A cloud build obfuscates in memory and keeps nothing, except the Protection Map you asked it to store, which you can turn off. Telemetry is on by default, reports when a build reports an error-level diagnostic, never on a clean build, and turns off with one env var.

## Cloud & Pro
- [Pro](https://www.afterpack.dev/docs/pro.md): Free protects your whole bundle uniformly. Pro lets you apply the heaviest protection only where it matters: per region, per file. It also keeps a record of every build.
- [Cloud API](https://www.afterpack.dev/docs/cloud-api.md): The wire contract for api.afterpack.dev: authentication, the batch obfuscation endpoint, limits, rate limits, the build time budget, and the diagnostic codes a client has to handle.
- [Deployment modes](https://www.afterpack.dev/docs/deployment-modes.md): Two ways to run the engine: locally on your machine, or in AfterPack's cloud with a Pro key.
- [Cloudflare Workers](https://www.afterpack.dev/docs/workers.md): Run the Free engine inside your own Worker with @afterpack/wasm, pass a key so the same call runs Pro, and what an AfterPack-supplied wrapper on Workers for Platforms would change.

## Dashboard
- [Dashboard](https://www.afterpack.dev/docs/dashboard.md): What the AfterPack dashboard shows, how it is organized, and which builds appear in it.
  - [Workspaces & projects](https://www.afterpack.dev/docs/dashboard/workspaces.md): The two objects everything else in the dashboard hangs off: who can do what in a workspace, how projects group builds and keys, and what the settings pages change.
  - [Builds](https://www.afterpack.dev/docs/dashboard/builds.md): The per-build record of every Pro Cloud build: coverage, inflation, complexity, build time, cost, diagnostics, and the Protection Map.
  - [API keys](https://www.afterpack.dev/docs/dashboard/api-keys.md): Minting, scoping, using, and revoking the key that turns a local build into a Pro Cloud build.
  - [Usage & billing](https://www.afterpack.dev/docs/dashboard/usage.md): Reading the usage meter, the three pools a build draws from, the plan tile's status line, and what the billing page lets you change.

## Plans & billing
- [Tiers](https://www.afterpack.dev/docs/tiers.md): Free runs the full pipeline: complexity is unbounded and every preset is available. What changes between tiers is how surgically you can apply protection, and how many MB of Pro builds you get each month.
- [Accounts](https://www.afterpack.dev/docs/accounts.md): What an AfterPack account is for, what lives on your personal account page, and where the workspace, key, usage and billing docs are.
- [SLAs, SLOs & support](https://www.afterpack.dev/docs/sla.md): What's a target vs. a contractual guarantee for the Pro cloud API, how incidents are handled, and which support channel applies at each tier.
- [Enterprise](https://www.afterpack.dev/docs/enterprise.md): A custom contract: priority on custom development, a private engine installation in your own cloud, a joint security review, and two deployment shapes for source that cannot leave your infrastructure.

## Reference
- [Comparison](https://www.afterpack.dev/docs/comparison.md): How AfterPack compares to javascript-obfuscator, js-confuser, JScrambler, JSDefender and ByteHide, and why per-build polymorphism requires no fixed structure underneath it.
- [Performance](https://www.afterpack.dev/docs/performance.md): What AfterPack costs a build: measured obfuscation time on a 185 KB bundle, the wasm build's time and download size, and the output size multiplier each preset produced.
- [Diagnostics](https://www.afterpack.dev/docs/diagnostics.md): Every DIAG_* code AfterPack emits, what triggered it, how to resolve it, and the exit codes a build returns.
- [Glossary](https://www.afterpack.dev/docs/glossary.md): AfterPack's documentation vocabulary: polymorphism, non-materialization, reversal classes, and the rest, defined once.

## Help
- [FAQ](https://www.afterpack.dev/docs/faq.md): The most-asked questions about AfterPack, answered in a few short paragraphs each.