Downloads · desktop project workflow

Download JavaScript Obfuscator for Windows

Protect JavaScript files and manage repeatable project settings from your Windows desktop. Choose your download below, then check the engine mode and plan requirements before your first release.

Need source to stay on your device? WinUI 3 Local Standard handles plain ES5 .js offline. Local Advanced handles modern .js/.jsx and mixed HTML/server-script files source-locally after an online paid-plan check. VM bytecode protection uses the hosted service.

Download WinUI 3 v3.4.5 Which App Should I Pick? Security Evidence

Obfuscating JavaScript files one by one can be time consuming. The desktop app lets you protect whole projects in just a few clicks.

Choose A Download

Which JavaScript Obfuscator download should I choose?

The browser tool is best for quick validation. WinUI 3 offers offline basic ES5 .js protection and paid source-local protection for modern .js/.jsx and mixed HTML/server-script files, with the protection report written on-device. Use hosted mode for VM bytecode.

Legacy compatibility

Windows Forms

Smallest download, broadest Windows compatibility, and the fastest way to manage and protect folders through the hosted service.

Review Windows Forms ›
Recommended

WinUI 3

Use WinUI 3 on Windows 10+ for offline ES5, paid source-local modern .js/.jsx, or hosted mixed-file and VM workflows.

Review WinUI 3 ›
Automation

Integration Package

Advanced teams can connect protection to release jobs after the desktop or online workflow proves the settings.

Review integrations ›
Try Online Obfuscator Compare Plans Review Security Evidence
Windows Forms download

JavaScript Obfuscator for Windows — Windows Forms

Legacy compatibility Most Compatible

Lightweight desktop client for protecting JavaScript projects through the hosted service. It is small, fast to launch, and works on older Windows versions.

  •  Batch processing and embedded JavaScript support
  • Same protection engine as the modern Windows app
  • Hosted protection and login traffic use HTTPS
  • API credentials are encrypted for the current Windows user and excluded from saved project files
  • Smaller download (~190 KB)
  • Requires .NET Framework 4.x (already installed on most Windows)
  • Runs on Windows 7 SP1 and later (32 or 64-bit)
Using an older Windows Forms build? Copies from before 2026‑07 may be configured to reach the service on the www. host, which now redirects. A redirect cannot carry a SOAP request, so the app reports either a 301 Moved Permanently network error or an incorrect key/password — your credentials are not actually at fault. Fix it without reinstalling by saving this file as javascriptobfuscator.exe.config next to javascriptobfuscator.exe: 
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <appSettings>
    <add key="ServiceUrl" value="https://javascriptobfuscator.com/JSOService.asmx" />
  </appSettings>
</configuration>

Re-downloading this package also resolves it, and the WinUI 3 app above is unaffected.

Download ›

~199 KB · .zip

Windows download

JavaScript Obfuscator for Windows — v3.4.5 (WinUI 3)

New Recommended Maximum Protection

Modern Windows app with offline Local Standard for basic ES5 .js, plus source-local Local Advanced for modern .js/.jsx and mixed HTML/server-script files after an online paid-plan check. Optional protection reports (with polymorphism fingerprint) can be enabled when a build needs a .report.json sidecar; they are off by default. Hosted mode remains available for VM bytecode protection. Self-contained — no separate .NET install required. Requires Windows 10 build 17763 (October 2018 Update) or later, 64-bit.

  • Local Standard: offline, no credentials, basic ES5 .js identifier protection
  • Local Advanced: source stays on-device (modern .js/.jsx and mixed HTML/server-script files); paid plan/options are checked online before processing; optional protection reports are off by default; VM bytecode is excluded
  • Command line: cli\jso-local.exe <project.jsoproj> runs the same pipeline from CI — Local Standard needs no credentials; Local Advanced reads JSO_API_KEY / JSO_API_PASSWORD
  • Hosted Standard / Balanced / Maximum protection presets for modern syntax and advanced options
  • Plan-labelled presets and advanced options, with one preflight message before any source upload
  • Hosted Runtime Defense: Debug Protection (anti-debugger), Domain Lock, Date Lock
  • Clear success messages after protection completes
  • Self-contained — no .NET install required
  • Windows 10 build 17763 or later (64-bit)
Download ›

~94 MB · .zip

advanced integration package

Advanced Integration Package

Advanced Optional

This package is for teams that want to connect JavaScript Obfuscator to an existing release process. Most end users should download one of the Windows desktop apps above.

  • Optional advanced download for release automation
  • Useful when protection must be part of an existing release process
  • Desktop app remains the recommended download for most users
  • Choose the tarball for package install or the zip for direct distribution

Docs: Advanced integration guide

Download .tgz › Download .zip

Version 0.4.13 · includes verified examples and release checks

local stack-trace symbolicator

Local Stack-Trace Symbolicator

Zero-dependency Node CLI for demangling protected stack traces and captured Sentry, Bugsnag, Rollbar, Datadog, Honeybadger, Raygun, Airbrake, and AppSignal events. Maps and event data stay on your machine.

Version 0.5.0 · Node 18+ · direct download, not an npm-registry package

Download .tgz › Download .zip
runtime event forwarder

Runtime Defense Event Forwarder

Customer-operated Node collector for Slack, Discord, Splunk HEC, Elasticsearch, and HMAC-signed webhooks. Includes body/header token authentication, token stripping, a 256 KB intake limit, and bounded retries.

Version 0.2.0 · Node 18+ · forwarding software, not staffed monitoring

Download .tgz › Download .zip
Electron bytecode adapter

Electron Bytecode Adapter

Post-protection adapter for Electron V8 cached data. The Node test suite validates scaffold mode, manifest and header handling, and failure behavior; generate release bytecode under the exact Electron version you ship.

Version 0.1.0 · Node 18+ · direct download, not an npm-registry package

Download .tgz › Download .zip
React Native runtime defense adapter

React Native Runtime Defense Adapter

Mobile guard, Metro integration, and Android/iOS probe templates for root, jailbreak, hooks, emulator, and signing signals. Device-specific behavior must still be validated in your supported app and OS matrix.

Version 0.2.0 · Node 18+ · direct download, not an npm-registry package

Download .tgz › Download .zip
advanced integration

C# Integration Guidance

Use the maintained client contract and keep API credentials in server-side configuration. The retired legacy .NET 2.0 sample is no longer recommended.

Open client guidance ›
web service integration

Browser API Safety Note

Do not put API credentials in browser JavaScript. Use a server-side integration or the maintained release package instead.

Open maintained integration ›

Verify download integrity

Compare the SHA-256 digest after downloading. The manifest covers every archive linked on this page; a mismatch means the file is incomplete, stale, or not the reviewed artifact.

Download SHA256SUMS.txt

PowerShell: Get-FileHash .\downloaded-file.zip -Algorithm SHA256

Permanent version links. The buttons above always serve the current release, so their bytes change when a new one ships. These URLs never change once published — use them when something needs to pin a checksum, such as a package manager manifest, a Dockerfile, or an offline mirror:

Both are byte-identical to the matching button above and are listed in SHA256SUMS.txt.

Publisher-signing status: the WinUI 3 desktop app and its bundled jso-local CLI are Authenticode-signed as richscripts inc and RFC 3161 timestamped, so Windows shows a named publisher. The legacy Windows Forms build below is signed with the same identity. The archived -2.4.7.1 copy in the checksum list predates signing and is unsigned; it is kept byte-for-byte so previously published checksums stay valid. SmartScreen additionally builds reputation per file, so a brand-new release can warn until it has been downloaded enough times — that is true of every certificate type since 2024 and is not a signing fault. The SHA-256 manifest verifies bytes only; it does not authenticate a Windows publisher identity.

Recommended next steps

  • Use the online obfuscator to test a small sample first.
  • Download the Windows Forms app if you want the smallest and most compatible desktop version.
  • Download the modern Windows app if you prefer a newer interface and use Windows 10 or later.
  • Use the advanced integration downloads only when your team specifically needs them.
  • For procurement or security review, open the Security Evidence hub to review desktop source handling, runtime monitoring, payment-page evidence, and VM proof paths.
  • Need a smaller download or want to run on older Windows (7 SP1+)? The Windows Forms build (~190 KB) runs the same core obfuscation engine and requires only .NET Framework 4.x.

Before protecting your first project

  1. Keep your original files and choose a separate output folder.
  2. Check whether your selected engine runs locally or uploads source to the hosted service.
  3. Review plan eligibility for the options you intend to use. A free download does not mean every protection option is free.
  4. Start with a representative sample, then run your application's tests against the protected output. Use the compatibility validation guide before publishing.

Need help? Send support your app version, Windows version, selected engine mode and error message. Do not include your password or API key.

Frequently asked questions

Which download do I need?

It depends on whether you want a desktop application or a build-pipeline tool. The Windows desktop applications give you a graphical workflow for protecting files and saving projects, which suits manual releases and inspection. If protection needs to happen in CI, the npm CLI and bundler plugins are the better fit and are installed from the package registry rather than downloaded here.

Do the desktop applications send my source code anywhere?

That depends on which engine path you choose. The local engine runtimes protect on your own machine, so source stays on the device while an entitlement check still happens online. Other paths use the hosted service and upload the selected JavaScript. Decide this deliberately and write it down, because it is the question a security reviewer will ask first.

How do I verify a download is the file you published?

Compare the checksum against the published value before running anything. Every public archive is listed with a checksum for exactly this purpose, and verifying is the difference between trusting the file and trusting the network that delivered it. Signed release verification covers the same ground for artifacts produced by your own protected builds.

Are the desktop applications Windows only?

The graphical applications are Windows desktop software, yes. Cross-platform workflows are covered by the npm CLI and the bundler plugins, which run wherever Node runs, and by the HTTP API for anything that needs to be driven from another language or operating system.

Do I need a paid plan to use these?

The tools install freely and the option set available to a given account depends on its plan. Several transforms and the hosted API are tied to paid tiers, so the practical answer is that you can install and evaluate, and the specific options your builds may use follow your entitlement. Check the plan comparison for which transforms sit at which tier before designing a pipeline around one.

How do I know which version I am running?

Check the version shown in the application. In the modern Windows app, protection reports are optional and off by default; enable them when you need a .report.json sidecar. When reporting a problem, include your app version, engine mode and protection options. Test the protected output before publishing it.