Obfuscate Luau locally. Review leaks. Verify your exported artifact.
Add your script, choose your settings,
and make it harder to read.
Find environment reads, sensitive names and log sinks for review. Nothing is blocked, hidden or uploaded. This heuristic is not data-flow analysis and can miss issues or flag safe code.
A SHA-256 digest checks whether exported text changed. It is not a signature, encryption or runtime anti-tamper protection. Keep your trusted digest separately.
Verification stays in your browser.
Comment removal, token-safe compaction and decimal string escapes reduce readability without adding a decoder or executing your script.
Determined readers can reverse these transforms. Keep secrets and authorization checks on your server, not inside client scripts.
Identifiers, APIs, types, long strings and existing escapes are preserved. Backtick interpolated strings are deliberately rejected, not rewritten. Compiler directives are retained. No variable renaming, control-flow flattening, VM wrapping, encrypted loaders or anti-debugging. The review audit does not defeat logging or monitoring. A Rust parser-based CLI is included in the source package; this browser tool uses JS/WASM. Syntax checks don’t prove runtime equivalence; test output in your own environment. Whitespace compaction can change source columns, so debugging positions may differ.