Nebula parses your script into a real syntax tree — not regex tricks — then renames, encrypts, and restructures it. The logic runs exactly the same. Reading it by eye does not.
Variables, functions, and parameters are replaced with short, meaningless names throughout the tree.
String literals are encoded and decoded at runtime, so plain text never sits in the source.
Numeric literals are rewritten as hex values or small expressions that evaluate to the same result.
Linear logic is reshaped into a state-driven switch loop, hiding the original execution order.
Unreachable branches and decoy logic are scattered through the output to confuse static analysis.
Selected logic is compiled into a small custom instruction set, run by an interpreter bundled into the output.
Whitespace, comments, and line breaks are stripped once every other pass is done, shrinking the final file.
Each encrypted string is broken into chunks and reassembled at runtime, so no single value holds the full payload.
The physical order of encrypted strings is randomized, breaking any assumption that index order matches usage order.
String accessor indices are offset by a random amount before lookup, decoupling the visible index from the real one.
String indices are passed as hexadecimal strings rather than plain numbers, adding another layer of noise to trace.
Random wrapper functions are scattered through the output, each forwarding to the real string decoder unpredictably.
A canary function detects if the output has been reformatted or beautified, and disrupts execution if tampering is found.
Overrides console.log and friends at runtime, so debugging output stays silent in production.
Remaining string literals are written as \u escape sequences in the final output, hiding readable text at a glance.
Drop your source straight into the input editor, or upload a .js file from your machine.
Toggle any combination of the protection layers to match how aggressive you want the output to be.
Grab the obfuscated file straight from the output panel once the pipeline finishes.
No. Every pass preserves the exact runtime behavior of your script — only its readability changes.
Yes, each account has a daily run limit shown in the workspace. It resets at midnight UTC.
New accounts start unauthorized. Sign up, then use the chat button (bottom-right, once signed in) to send your account ID and request access — it's the fastest way to reach support.
Your source is sent only to process the obfuscation request — the interface itself keeps nothing beyond your daily usage count.