Obfuscate Luau locally. Review leaks. Verify your exported artifact.
Add your script, choose your settings,
and make it harder to read.
Conservative: broader Luau syntax. No runtime wrapper.
Find environment reads, sensitive names and log sinks for review. This review does not block, hide or upload anything. VM compilation separately rejects direct environment/introspection names. This heuristic is not data-flow analysis and can miss issues or flag safe code.
A SHA-256 digest checks whether exported text changed. It is not a signature, encryption or runtime anti-tamper protection. Keep your trusted digest separately.
Verification stays in your browser.
Conservative mode keeps the existing lightweight transforms. VM v3 uses a rebuilt AST compiler, diversifies instructions and constant storage for each build, then emits a standalone Luau interpreter with bounded container validation. Neither mode runs your source here.
Determined readers can reverse these transforms. Keep secrets and authorization checks on your server, not inside client scripts.
Conservative mode preserves APIs/types and rejects backtick interpolation. VM v3 supports untyped Lua 5.1-compatible Luau: locals, lexical closures/upvalues, recursion, if/do, while/repeat/numeric and explicit iterator for loops with break, tables, indexing, methods, arithmetic, short-circuit logic, varargs and nil-containing multiple returns. VM mode rejects types, +=, continue, generalized iteration, backticks, global assignment and environment/stack introspection. Input limit: 32 KiB; 128 functions, 12,000 instructions. Generated output needs Luau table.pack/table.unpack. Ordinary Roblox globals are referenced by name but Roblox host behavior has not been tested. Numeric for needs numeric controls and nonzero step. Debug positions, stack traces, function identity and introspection differ. Encoded strings and instructions are scrambled per build. Checks detect container corruption before execution; they are not authentication. Defaults: 2 million VM instructions and 128 nested VM calls; exceeding either safely errors. Embedded keys remain recoverable. Local library caches do not prevent pre-existing hooks. Runtime dependencies are checked for availability, not authenticity. Client-side code cannot be made dump-proof or hook-proof. No unhookability, Prometheus compatibility or production-grade protection is claimed. The Rust CLI remains a separate parser-backed cleanup tool; VM compilation runs locally in JavaScript. Exported code executes only when you run it in the target host. Test there before shipping.