# AfterPack quickstart: obfuscate a build in minutes

Pick your framework, install one dev dependency, build, and open the Protection Map.

Source: https://www.afterpack.dev/docs/quickstart

## Pick your framework

*(interactive framework picker — pick a framework below or see the web page)*

## What a build does by default

- **The `light` [preset](https://www.afterpack.dev/docs/config#preset)**: [complexity](https://www.afterpack.dev/docs/config#complexity) 2, with string literals [encoded](https://www.afterpack.dev/docs/config#strings-encode). Raise the preset as a project needs more; see [Presets](https://www.afterpack.dev/docs/presets).
- **A new random [seed](https://www.afterpack.dev/docs/config#seed) every build**, so two builds of the same source come out structurally different. [Build once and promote the same bytes](https://www.afterpack.dev/docs/builds); pin `seed: "git"` only when you need reproducible output.
- **Dev builds are untouched.** The plugin acts on the [production](https://www.afterpack.dev/docs/config#build-mode) build only.
- **It fails closed.** A file the engine cannot obfuscate fails the build and names the file. See [Exit codes](https://www.afterpack.dev/docs/diagnostics#exit-codes).

To keep the plugin installed but skip the engine for one run, set [`build.autorun`](https://www.afterpack.dev/docs/config#build-autorun) to `false`.

## Check the result

The [Protection Map](https://www.afterpack.dev/docs/protection-map) is your original source, colored by how strongly each line came out. It is written to `.afterpack/protectionMap.html` when the bundler emitted a source map; each framework guide shows how to turn it on. The report contains your full source. Never commit or serve it. `.afterpack/` is added to your `.gitignore` for you.

*(live Protection Map demo embed — see https://www.afterpack.dev/protection-map-demo.html)*

Open the [live demo report](https://www.afterpack.dev/protection-map-demo.html) to see one before your first build.

## Protect specific code harder

Global obfuscation covers the whole bundle. To push one region further, or to leave one alone, mark it with a [directive](https://www.afterpack.dev/docs/directives):

```ts
/* @afterpack preset=hard */
function checkLicense(token: string) {
  return verify(token);
}
/* @afterpack end */

const apiKey = /* @afterpack preset=extreme */ "YOUR_SECRET";
```

Directives take effect on [Pro](https://www.afterpack.dev/docs/tiers) builds; [Directives](https://www.afterpack.dev/docs/directives) is the reference for the grammar and every key one can set.

## Next

- [How AfterPack works](https://www.afterpack.dev/docs/concepts): what an attacker can and cannot recover.
- [Configuration](https://www.afterpack.dev/docs/config): every option and where to set it.
- [Best practices](https://www.afterpack.dev/docs/best-practices): what to mark, what to leave alone, and CI.