AfterPack
This page is available in English only.
View as Markdown

Obfuscate plain JavaScript

Point npx afterpack@latest at any directory of emitted JavaScript. No bundler, no plugin, no config file required.

No plugin, no framework, no bundler hook. Give the CLI a directory and it obfuscates every .js, .mjs and .cjs inside it, in place. Use it for a hand-built CDN bundle, a tsc output tree, vanilla ESM, a require.js/AMD app, or any dist/ from a tool with no AfterPack package.

Install

There is nothing to install: run the CLI directly against your output directory.

$ npx afterpack@latest

Build

The path is required. There is no auto-detection, no zero-argument form. It takes a directory to walk, or a single .js/.mjs/.cjs file. If the directory doesn't exist, or holds no .js/.mjs/.cjs, the CLI says so and exits 1.

If it does spot next, vite, webpack, rollup or esbuild in your package.json, it prints a one-line nudge toward the matching plugin after the run.

See Configuration for every key. On this path you set one in afterpack.json in your project root, a CLI flag, or an environment variable. For complexity, pick one:

npx afterpack@latest dist/ --complexity=40
AFTERPACK_complexity=40 npx afterpack@latest dist/
{ "complexity": 40 }

Value flags take = (--preset=hard, --seed=git); a boolean flag is bare for true and =false for off (--build.backup, --directives.enabled=false). -h/--help and -v/--version print usage. CLI reference has the full command shape; Configuration has every key. Exit code is 0 on success and 1 on any failure. There are no other codes to branch on in CI.

The run writes:

  • .afterpack/protectionMap.html: one combined map for the run, written when a source map was discoverable and the build isn't running under NODE_ENV=production / CI=true. It embeds your original source, so it always lands in the gitignored .afterpack/, never in the directory you obfuscated.
  • foo.js.map: a .map sibling, when maps are on.
  • .afterpack/backup/: your originals, mirrored under the project root with a manifest, on every run. --build.backup=false opts out; npx afterpack@latest restore undoes the run from it.

AfterPack also appends its guard globs (.afterpack/, protectionMap.html, *.protectionMap.html, *.backup.*, *.map) to your .gitignore.

Verify

Turn on a source map for the build you want to inspect (tsc --sourceMap, a bundler flag), then open the gitignored .afterpack/protectionMap.html. It contains your full source. Never commit it or serve it.

Options

Every configuration key works through this path too; see Configuration for every key and every place it can be set.

Directives

The CLI reads directives when the input carries a source map. See Directives.

Edge cases

  • No source map, less to see. Without a discoverable map, the Protection Map has no original source to render, and the run's report is thin. If your build can emit maps (tsc --sourceMap, a bundler flag), turn them on for the build you want to inspect, then keep them out of your release.
  • Nothing framework-aware. AfterPack sees files.

Next