Documentation
AfterPack documentation
A post-build step that obfuscates the JavaScript your bundler produces. One dev dependency, one line; production output ships unreadable, development stays untouched.
Kick off with an agentPaste into Claude Code, Codex, Cursor or Copilot
Where do you want to start?
Quickstart · Frameworks
Get AfterPack into your build
Install the plugin and ship obfuscated output from your normal build — five minutes.
Start here
Concepts · Tiers
Evaluate it for my team
How AfterPack works, the threat it answers, and what each plan ships.
Start here
Best practices · Protection Map
Protect secrets & license logic
Mark high-value code with region directives so it gets the heaviest treatment, and read the Protection Map.
Start here
Reversal classes · Threat model
See what an attacker gets
The three reversal classes, what each one costs a reader of your bundle, and where the honest limits are.
Start here
Every token, scored by how hard it is to reverse
Dim is untouched; green to red marks rising obfuscation complexity. Hover any token to see the transforms that ran and why. The preset ladder moves the whole bundle. Directives move one region.
entitlements.js, 54 lines, built at the medium preset with a directive around the signature check. Click any token to see what was applied to it.Use it when
- •The browser receives logic someone would pay to copy or bypass: a license check, pricing rules, anti-cheat, a paywall, an embedded SDK.
- •A customer or a security questionnaire asks whether the JavaScript you ship is readable.
- •You want a build that stays unchanged in development and fails rather than ships weaker output.
Reference
Set it up
Configure it
Understand it
- How AfterPack worksPer-build polymorphism, no peelable layers→
- Protection MapWhich class hit which line→
- Threat modelWhich attackers it stops→
- Reversal classesWhat an attacker actually recovers→
- ComparisonAgainst the tools you already know→
- TiersWhat ships in each plan, line by line→
- FAQThe questions that come up first→
Use cases
- Paywall checksRaise the cost of finding and patching a gate→
- Pricing & gating logicKeep plan limits from reading as a spec→
- Shipped API keysWhat a key needs beyond obfuscation→
- Accidental secretsA credential already reached a deployed bundle→
- Patching toolsMake a text-matching patch go stale on release→
- Unreleased featuresKeep the bundle from previewing the roadmap→
- Security scannersWhat an automated reader checks in a bundle→
- Electron license logicMain, preload and renderer license checks→
- Browser extensionsBackground and content scripts, and store policy→