BYTEHIDE SHIELD FOR NODE.JS
Node.js Obfuscator
Protect your Node.js code against reverse engineering, copying, and tampering. ByteHide Shield obfuscates your server-side JavaScript with the CLI.
Get started
CLI
npm install -g @bytehide/shield-cli
shield protect "src/**/*.js" --token YOUR_TOKENInstall the CLI globally, then protect any Node.js file or glob with one command. Add it to your build script so every release ships protected.
Full setup guide in the docsFree to use with a ByteHide account
The first time Shield runs, it asks for a project token that connects it to your account. The package is free.
Get your free tokenHow it works
How to obfuscate Node.js code
Node.js code can be obfuscated as a step in your build. Three steps.
Step 01
Install the Shield CLI
Install @bytehide/shield-cli globally or as a dev dependency.
Step 02
Add your project token
Create a free ByteHide account, get your token, and pass it to the CLI or a config file.
Step 03
Protect your code
Run shield protect on your built files. Add it to your build script so every release ships protected.
Why obfuscate
Why obfuscate Node.js code
Node.js code does not run in a browser, but it still gets distributed. The moment your code leaves your servers, it can be read.
- Distributed Node code can be readCLI tools, npm packages, desktop apps built on Node, and self-hosted software all ship your JavaScript to someone else's machine. There it can be inspected.
- Your business logic and licensing live in the codeServer-side code often holds licensing checks, proprietary algorithms, and integration logic. Readable, they can be bypassed or copied.
- Obfuscation protects code you cannot keep on your serversFor anything that ships to a customer or a device, obfuscation is what stands between your logic and an attacker.
Example
See Node.js obfuscation in action
Obfuscation is easier to understand when you see it. Here is a small Node.js module before and after Shield protects it.
const crypto = require('crypto');
function validateLicense(key) {
const expected = process.env.LICENSE_SECRET;
const hash = crypto.createHash('sha256').update(key).digest('hex');
return hash === expected;
}
module.exports = { validateLicense };var _0xb3=['sha256','hex','LICENSE_SECRET'];(function(_a,_b){var _c=function(_d){while(--_d){_a['push'](_a['shift']());}};_c(++_b);}(_0xb3,0x1f2));var _0x4e=function(_a,_b){_a=_a-0x0;return _0xb3[_a];};var _0x7a=require(_0x4e('0x0'));function _0x1c(_k){var _s=0;while(1)switch(_s){case 0:var _e=process['env'][_0x4e('0x2')];_s=1;break;case 1:var _h=_0x7a['createHash'](_0x4e('0x0'))['update'](_k)['digest'](_0x4e('0x1'));_s=2;break;case 2:return _h===_e;}}
module['exports']={_0x1c};Same behavior, unreadable result. The obfuscated output reveals nothing about your license logic or environment variable names.
What it covers
What ByteHide Shield protects in your Node.js code
Shield applies its protection to your Node.js source as part of your build. Here is what that covers.
- Business logicThe functions, algorithms, and control structures that define how your Node.js application works become unreadable in the shipped output. The behavior is identical, the logic is not legible.
- Licensing and auth logicLicense validation, authentication checks, and access control logic are encrypted and restructured so they cannot be read or bypassed by inspecting the code.
- Strings and credentials patternsAPI endpoints, environment variable names, keys, and configuration values are encrypted so they cannot be read by scanning the output file.
- Every project, every buildProtection runs as part of your build script, so every release ships obfuscated automatically. There is no manual step to forget.
Server-side code that ships is just as exposed as a browser bundle. Shield protects it the same way.
When to use
When does Node.js code need obfuscation
Not all Node.js code carries the same exposure. The real risk is Node code that ships to someone else's machine.
- Server code you control vs code you distributeNode.js running only on your own infrastructure has a smaller exposure. The real risk is Node code that ships: CLI tools, Electron apps, npm packages, on-premise software.
- Electron and desktop appsAn Electron app is Node.js code on the user's machine. Anyone can open the package and read it. Obfuscation is essential there.
- Distributed npm packagesIf you publish or share a Node package, its source is readable by everyone who installs it. Obfuscation protects the parts that are proprietary.
Where your code runs decides whether obfuscation is optional or essential.
Free tool vs Shield
Free obfuscator vs ByteHide Shield
For a quick test of a single JavaScript file, the free online obfuscator is enough. For a real Node.js project, ByteHide Shield protects the whole build.
ByteHide Shield
Production-grade protection
The free online tool obfuscates single JavaScript files. ByteHide Shield protects a full Node.js project, built into your pipeline.
Open the free JavaScript obfuscatorFrequently asked questions
What is a Node.js obfuscator?
Does Node.js code need obfuscation if it runs on my server?
How do I obfuscate an Electron app?
How do I add Shield to a Node project?
Is it free?
Will obfuscation affect Node performance?
What is the best Node.js obfuscator?
Protect your Node.js code with
ByteHide Shield
For server code that ships, obfuscation is essential. ByteHide Shield adds code virtualization, runtime self-protection, and advanced configuration, integrated through the CLI.
