# AfterPack documentation

A post-build step that obfuscates the JavaScript your bundler produces. One dev dependency, one line; production output ships unreadable, development stays untouched.

Source: https://www.afterpack.dev/docs

> Stop shipping your source code. Every bundle you deploy is your source: a coding agent now reads, explains and rewrites minified JavaScript in minutes, so minified only means published in a smaller font. AfterPack is the post-build step that closes that gap. One dev dependency, one line, and your production output ships with its names renamed and its strings encoded, so no reader, human or model, can grep it for your logic or lift it as written. Every build has a different shape, so tools written against one build's patterns break on the next. It runs after your bundler, never touches your source, and can hand you a Protection Map of exactly what changed. It does not turn a client-side secret into a server-side one: someone who runs your code can still read the values it uses.

## Use it when
- The browser receives logic someone would pay to copy or bypass: a license check, pricing rules, anti-cheat, a paywall, an embedded SDK.
- A customer or a security questionnaire asks whether the JavaScript you ship is readable.
- You want a post-build step that leaves development untouched.

## Skip it when
- Everything valuable already runs on the server and the client is a thin view.
- The code is open source or is meant to be read.
- You need a secret to stay secret in the browser: no obfuscator does that, and AfterPack says so.

## Everything in one file
- [Full docs corpus](https://www.afterpack.dev/llms-full.txt): every page below, concatenated.
- [Configuration as JSON](https://www.afterpack.dev/docs-config.json): the registry, machine-readable.
- [Roadmap](https://www.afterpack.dev/roadmap.md): what has shipped and what is next.

## Getting started
- [Overview](https://www.afterpack.dev/docs.md)
- [Quickstart](https://www.afterpack.dev/docs/quickstart.md): Pick your framework, install one dev dependency, build, and open the Protection Map.
- [Best practices](https://www.afterpack.dev/docs/best-practices.md): How to ship obfuscated JavaScript by default, mark the regions that matter with directives, and keep rotating your build so attackers can't get ahead.
- [How AfterPack works](https://www.afterpack.dev/docs/concepts.md): What standard (Free) output does to your code, how it resists reversal, and what an attacker can actually recover.

## Guides
- [Build & CI](https://www.afterpack.dev/docs/builds.md): Where AfterPack sits in your pipeline: production only, build once and promote everywhere, with a CI recipe and the rules for seeds, artifacts, source maps, and a down cloud.
- [Protection Map](https://www.afterpack.dev/docs/protection-map.md): The HTML report that shows what AfterPack did to your code: every token coloured by how much transformation it went through.

## Use cases
- [Paywall checks](https://www.afterpack.dev/docs/use-cases/paywall-checks.md): A paywall gate in the bundle is a named function returning a boolean, and flipping it is a one-line patch. What obfuscation and a per-build seed change about finding it and keeping the patch working.
- [Pricing & gating logic](https://www.afterpack.dev/docs/use-cases/pricing-logic.md): Plan limits, quota thresholds and feature-flag rules in client JavaScript read as a specification of your commercial model. How to stop them being readable, and what stays observable anyway.
- [Shipped API keys](https://www.afterpack.dev/docs/use-cases/shipped-api-keys.md): Restrict it, proxy it, rotate it, then obfuscate what is left. What encoding a credential in your bundle actually buys, and where it stops.
- [Accidental secrets](https://www.afterpack.dev/docs/use-cases/accidental-secrets.md): A credential reached a deployed bundle. How to find out what your live site exposes right now, what the next build changes for the value, and why rotation is the step that closes it.
- [Patching tools](https://www.afterpack.dev/docs/use-cases/patching-tools.md): A userscript, a Tampermonkey patch or an extension has to anchor on a name, a string or a recognisable shape in your JavaScript. What structural obfuscation and a new build shape do to those anchors.
- [Unreleased features](https://www.afterpack.dev/docs/use-cases/unreleased-features.md): Flag names, route strings and unreleased UI text ship to every visitor before you announce anything, and people diff bundles between releases. What to strip, what to protect, and what to keep out of the build entirely.
- [Security scanners](https://www.afterpack.dev/docs/use-cases/security-scanners.md): Secret-shaped patterns, a sourceMappingURL back to your source, library fingerprints and a plain-or-minified label. What an automated reader checks, and what an obfuscated build changes in the report.
- [Electron license logic](https://www.afterpack.dev/docs/use-cases/electron-license-logic.md): app.asar unpacks with one command, and a local license or trial check is usually one comparison. How to obfuscate main, preload and renderer so a crack does not survive your next release.
- [Browser extensions](https://www.afterpack.dev/docs/use-cases/browser-extensions.md): A published extension is a zip anyone can unpack and read. What obfuscating the background and content scripts changes, and the store policy to check before you ship one.

## Frameworks
- [Frameworks](https://www.afterpack.dev/docs/frameworks.md): Which package to install for your stack, where it hooks, and what it writes.
  - [Angular](https://www.afterpack.dev/docs/frameworks/angular.md): Angular v17+ obfuscation is a postbuild pass over dist/<app>/browser: via the CLI, or the @afterpack/angular helper.
  - [Astro](https://www.afterpack.dev/docs/frameworks/astro.md): @afterpack/astro is a thin integration that wires @afterpack/vite into Astro's own Vite pipeline.
  - [Electron](https://www.afterpack.dev/docs/frameworks/electron.md): @afterpack/electron wires main, preload and renderer with one seed in a single call, and refuses electron-vite's bytecodePlugin and unguarded backups before they can ship your source.
  - [esbuild](https://www.afterpack.dev/docs/frameworks/esbuild.md): @afterpack/esbuild hooks build.onEnd and obfuscates the emitted output in place.
  - [Next.js](https://www.afterpack.dev/docs/frameworks/nextjs.md): @afterpack/next obfuscates the client JavaScript inside next build, on Turbopack or webpack, SSR or static export.
  - [Nuxt](https://www.afterpack.dev/docs/frameworks/nuxt.md): @afterpack/nuxt is a Nuxt 3 module that registers @afterpack/vite on Nuxt's Vite config.
  - [Parcel](https://www.afterpack.dev/docs/frameworks/parcel.md): @afterpack/parcel-optimizer obfuscates each packaged bundle in memory as a Parcel 2 Optimizer, and fails the build closed rather than ship a chunk that 404s in production.
  - [Plain JS](https://www.afterpack.dev/docs/frameworks/plain.md): Point npx afterpack@latest at any directory of emitted JavaScript. No bundler, no plugin, no config file required.
  - [Remix](https://www.afterpack.dev/docs/frameworks/remix.md): There is no @afterpack/remix package. Remix builds through Vite, so use @afterpack/vite, or run the CLI on the build output.
  - [Rollup](https://www.afterpack.dev/docs/frameworks/rollup.md): @afterpack/rollup reads directives from your source and runs the engine in generateBundle, before Rollup writes the output.
  - [Svelte](https://www.afterpack.dev/docs/frameworks/svelte.md): @afterpack/svelte wraps @afterpack/vite for Svelte projects: one plugin line in vite.config.ts.
  - [SvelteKit](https://www.afterpack.dev/docs/frameworks/sveltekit.md): @afterpack/sveltekit: one plugin line after sveltekit() in vite.config.ts.
  - [Vite](https://www.afterpack.dev/docs/frameworks/vite.md): @afterpack/vite obfuscates your build in generateBundle, before Vite writes it. It is the reference integration every other Vite-family package wraps.
  - [Vue](https://www.afterpack.dev/docs/frameworks/vue.md): @afterpack/vue wraps @afterpack/vite for Vue 3 projects: one plugin line in vite.config.ts.
  - [Webpack](https://www.afterpack.dev/docs/frameworks/webpack.md): @afterpack/webpack taps compilation.hooks.processAssets and obfuscates your assets before webpack writes them.

## CLI
- [CLI](https://www.afterpack.dev/docs/cli.md): Invoking npx afterpack@latest: an optional path, every config key as a flag, the verify, restore and audit subcommands, and the full exit-code contract.
- [Audit](https://www.afterpack.dev/docs/audit.md): Scan a live URL for public source maps, readable code and leaked credentials, and get a score out of 100. The same scanner that powers the public security scanner, from your terminal.

## Configuration
- [Configuration](https://www.afterpack.dev/docs/config.md): Every option, where to set it, and what it does.
- [Presets](https://www.afterpack.dev/docs/presets.md): The five protection levels from minify to extreme, the complexity target each one sets, and what the zero-config default (light) already guarantees.
- [Complexity](https://www.afterpack.dev/docs/complexity.md): The single dial behind every preset: what rises as the number climbs, the one threshold that flips at medium, and which transformations config can turn off but not force on.
- [Directives](https://www.afterpack.dev/docs/directives.md): Comments in your source that change AfterPack's protection for the code they mark.

## Security
- [Threat model](https://www.afterpack.dev/docs/threat-model.md): The security-review artifact for AfterPack: the asset it defends, what each attacker class recovers, how a secret survives, where the current scope ends, and the controls it sits alongside.
- [Reversal classes](https://www.afterpack.dev/docs/reversal-classes.md): The static-attacker classes AfterPack's transforms fall into, and what recovering each one gets an attacker.
- [Privacy](https://www.afterpack.dev/docs/privacy.md): A local build sends nothing. A cloud build obfuscates in memory and keeps nothing, except the Protection Map you asked it to store, which you can turn off. Telemetry is on by default, reports when a build reports an error-level diagnostic, never on a clean build, and turns off with one env var.

## Cloud & Pro
- [Pro](https://www.afterpack.dev/docs/pro.md): Free protects your whole bundle uniformly. Pro lets you apply the heaviest protection only where it matters: per region, per file. It also keeps a record of every build.
- [Cloud API](https://www.afterpack.dev/docs/cloud-api.md): The wire contract for api.afterpack.dev: authentication, the batch obfuscation endpoint, limits, rate limits, the build time budget, and the diagnostic codes a client has to handle.
- [Deployment modes](https://www.afterpack.dev/docs/deployment-modes.md): Two ways to run the engine: locally on your machine, or in AfterPack's cloud with a Pro key.
- [Cloudflare Workers](https://www.afterpack.dev/docs/workers.md): Run AfterPack inside your own Worker with @afterpack/wasm, pass a key so the same call runs Pro, and what AfterPack on Workers for Platforms would change.

## Dashboard
- [Dashboard](https://www.afterpack.dev/docs/dashboard.md): What the AfterPack dashboard shows, how it is organized, and which builds appear in it.
  - [Workspaces & projects](https://www.afterpack.dev/docs/dashboard/workspaces.md): The two objects everything else in the dashboard hangs off: who can do what in a workspace, how projects group builds and keys, and what the settings pages change.
  - [Builds](https://www.afterpack.dev/docs/dashboard/builds.md): The per-build record of every Pro Cloud build: coverage, inflation, complexity, build time, cost, diagnostics, and the Protection Map.
  - [API keys](https://www.afterpack.dev/docs/dashboard/api-keys.md): Minting, scoping, using, and revoking the key that turns a local build into a Pro Cloud build.
  - [Usage & billing](https://www.afterpack.dev/docs/dashboard/usage.md): Reading the usage meter, the three pools a build draws from, the plan tile's status line, and what the billing page lets you change.

## Plans & billing
- [Tiers](https://www.afterpack.dev/docs/tiers.md): Free runs the full pipeline: complexity is unbounded and every preset is available. What changes between tiers is how surgically you can apply protection, and how many MB of Pro builds you get each month.
- [Accounts](https://www.afterpack.dev/docs/accounts.md): What an AfterPack account is for, what lives on your personal account page, and where the workspace, key, usage and billing docs are.
- [SLAs, SLOs & support](https://www.afterpack.dev/docs/sla.md): What's a target vs. a contractual guarantee for the Pro cloud API, how incidents are handled, and which support channel applies at each tier.
- [Enterprise](https://www.afterpack.dev/docs/enterprise.md): A custom contract: priority on custom development, a private engine installation in your own cloud, a joint security review, and two deployment shapes for source that cannot leave your infrastructure.

## Reference
- [Comparison](https://www.afterpack.dev/docs/comparison.md): How AfterPack compares to javascript-obfuscator, js-confuser, JScrambler, JSDefender and ByteHide on build time, output size and whether the output still runs, measured on one harness.
- [Performance](https://www.afterpack.dev/docs/performance.md): What AfterPack costs a build and a page: measured obfuscation time on a 185 KB bundle, the wasm build's time and download size, the output size and runtime cost of each preset, what protected code pays to read a host global, and how a new seed affects caching.
- [Semantic contract](https://www.afterpack.dev/docs/semantic-contract.md): What AfterPack output preserves of your program's behavior, how each engine release is checked against real code, and the short list of deliberate differences.
- [Diagnostics](https://www.afterpack.dev/docs/diagnostics.md): Every DIAG_* code AfterPack emits, what triggered it, how to resolve it, and the exit codes a build returns.
- [Glossary](https://www.afterpack.dev/docs/glossary.md): AfterPack's documentation vocabulary: polymorphism, non-materialization, reversal classes, and the rest, defined once.

## Help
- [FAQ](https://www.afterpack.dev/docs/faq.md): The most-asked questions about AfterPack, answered in a few short paragraphs each.