AfterPack quickstart: obfuscate a build in minutes

Pick your framework, install one dev dependency, build, and open the Protection Map.

Pick your framework

What a build does by default

  • The light preset: complexity 2, with string literals encoded. Raise the preset as a project needs more; see Presets.
  • A new random seed every build, so two builds of the same source come out structurally different. Build once and promote the same bytes; pin seed: "git" only when you need reproducible output.
  • Dev builds are untouched. The plugin acts on the production build only.
  • It fails closed. A file the engine cannot obfuscate fails the build and names the file. See Exit codes.

To keep the plugin installed but skip the engine for one run, set build.autorun to false.

Check the result

The Protection Map is your original source, colored by how strongly each line came out. It is written to .afterpack/protectionMap.html when the bundler emitted a source map; each framework guide shows how to turn it on. The report contains your full source. Never commit or serve it. .afterpack/ is added to your .gitignore for you.

entitlements.jsmedium · complexity 8Open full size
entitlements.js, 54 lines, built at the medium preset with a directive around the signature check. Click any token to see what was applied to it.

Open the live demo report to see one before your first build.

Protect specific code harder

Global obfuscation covers the whole bundle. To push one region further, or to leave one alone, mark it with a directive:

/* @afterpack preset=hard */
function checkLicense(token: string) {
  return verify(token);
}
/* @afterpack end */

const apiKey = /* @afterpack preset=extreme */ "YOUR_SECRET";

Directives take effect on Pro builds; Directives is the reference for the grammar and every key one can set.

Next