Engineering notes on JavaScript protection
How obfuscation works, what it can and cannot do, and what's new on JsVM.MMO69.Com.
New subscription pricing: monthly & yearly cycles
Plans are now billed per cycle. A month is 30 days; a year is 365 days and saves 25% compared to paying monthly. You can buy several cycles at once (up to 96) and the expiry date stacks — buy 3 months of Pro today and 2 more next week, you're covered for 5.
Upgrading mid-cycle is now prorated automatically: the remaining time and the unused part of this month's quota become a credit that is subtracted from the new order, live, at checkout. Downgrading to a cheaper plan is free, keeps your paid-until date, and takes effect immediately.
Current prices: Pro $10/mo, Team $50/mo, Business $139/mo, extra storage $9/GB for the current month. All amounts include 10% VAT, paid via ACB bank transfer (auto-verified) or PayPal.
VM obfuscation vs minify vs bundling — what actually stops a reverse engineer?
Minifying and bundling make code smaller and messier to read, but the control flow stays intact: open DevTools, pretty-print, and every function, string and API call is still right there. It deters casual readers for about five minutes.
VM obfuscation takes a different route: your JavaScript is compiled into custom bytecode and shipped together with a small virtual machine that interprets it. There is no longer a 1:1 mapping between your functions and the shipped code — an attacker first has to understand the VM's instruction set before your logic even becomes readable.
The practical difference is cost. Reversing minified code costs minutes; reversing virtualized code costs days or weeks of expert work. Nothing is unbreakable — but when the cost of breaking exceeds the value of what's inside, protection has done its job.
5 practical tips before you obfuscate
1. Keep secrets out of the client. Obfuscation hides logic, not data — an API key embedded in browser code is a secret published to the world, no matter how it's scrambled.
2. Obfuscate the build, not the repo. Run protection as the last step of your build pipeline so you always have a clean, debuggable source of truth.
3. Test the protected build, not just the original. Source maps, dynamic eval and rare code paths occasionally surprise after transformation — run your test suite against the output.
4. Raise the level where it matters. With target-mode selection you can virtualize only the handful of functions that contain your secret sauce, keeping bundle size and startup time under control.
5. Layer your defenses: obfuscation + license checks + server-side validation. Each layer multiplies the attacker's cost.