Skip to content

JavaScript obfuscator

Turn JavaScript source into a hex-encoded eval(unescape(...)) snippet that hides it from a casual read.

Input
Output

JavaScript obfuscator

Paste any JavaScript source and this tool rewrites it as a single hex-escaped string that reassembles and runs itself with eval(unescape('...')). It is the classic "basic obfuscation" trick: every character of your code becomes a %XX (or %uXXXX for characters outside the first 256 code points) percent-escape sequence, so the source is no longer readable at a glance — no variable names, no string literals, no comments left in plain sight.

By default the output is wrapped in a self-executing function, (function(){eval(unescape('...'))})();, so you can drop the result straight into a <script> tag or another file and it runs immediately, exactly like the original. Turn off "Wrap in self-executing function" if you want the bare eval(unescape('...')); statement instead, for example to embed it inside a function you already control.

This is obfuscation, not encryption or security: unescape() and eval() are visible in the output, and decoding the hex string back to source is a one-line operation for anyone who looks — a browser console does it as fast as it can be pasted. Treat it as a way to deter casual copying or keep a snippet out of a quick view-source glance, not as a way to protect secrets, API keys or anything that actually needs to stay confidential.

Everything runs locally in your browser. The code you paste is never uploaded or sent anywhere, so it is safe to obfuscate proprietary or unreleased scripts. The live count under the output shows how many characters went in, how many came out, and how many bytes were hex-encoded, so you can see the size increase before you copy or download the result.

FAQ

Is this real security, or can the code be un-obfuscated?
It is not security. Anyone can run unescape() on the string inside the output and get your original source back in one step — this only hides the code from a quick glance, not from anyone who actually looks.
Will the obfuscated code behave exactly like the original?
Yes. eval(unescape('...')) reconstructs and runs the exact original source, character for character, including whitespace, line breaks and string contents.
What does "Wrap in self-executing function" do?
It wraps the eval(unescape('...')) call in (function(){...})(); so the result runs immediately as a standalone statement. Turn it off if you want to place the eval(unescape('...')); call inside your own function or scope.
Does it work on minified code too?
Yes. You can obfuscate any JavaScript text, minified or not — the tool treats the input as plain text and hex-encodes it character by character, so minifying first (with a CSS/JS minifier) just makes the encoded output shorter.
Is my source code uploaded anywhere?
No. The obfuscator runs entirely in your browser — the code you paste never leaves your device.