XOR Shield deployable string-obfuscation · no eval

Load your code (e.g. worker.js), tweak options, then Protect. The output stays a valid ES module — deployable to Cloudflare Workers (no eval is ever used).

Source file or paste

⇧ Drag & drop a .js / .mjs file here, or click to browse

Options

working...

Independently check a protected file: re-parses the output, extracts its embedded table + key, decodes every stored record, and byte-compares against the originals.

1 · Original source

📄 original worker.js

2 · Protected output

🛡 worker.protected.js
analyzing...

Paste-drop any file protected by this tool to audit its stored strings and extract the embedded key. Works fully offline — handy for maintenance or manual edits.

Protected file

🔎 drop worker.protected.js here

What it does

Ordinary whole-file wrappers decode the entire program at runtime — impossible on Cloudflare Workers, where eval() / new Function are blocked. XOR Shield instead obfuscates string literals:

  • Parses your ES module with an embedded acorn parser.
  • Every qualifying string literal is XOR-encoded (32-byte fresh key per run, length-prefixed records) into one packed hex/base64 table.
  • Literals are replaced in-place with _x?????(index) lazy-style calls; a tiny helper ships with the output and restores the exact original bytes at runtime. No eval — just array lookups.
  • Identifiers, numbers, regex literals and export statements stay untouched → the result is a valid ES module Worker and deploys to Cloudflare as-is.

Options

  • Min string length: strings shorter than this stay readable (default 5) — tiny strings like GET are not worth hiding and bloat the table.
  • Table format: hex doubles payload size, base64 grows ~33%. Hex decodes fastest.
  • Decoy marker: adds a cosmetic var _nsc?????=..." line, mimicking common "protected release" banners.

Testing against worker.js

  1. Protect → the app auto-runs the round-trip verify: re-parses the protected output, decodes every record through the same algorithm and byte-compares with all originals. Result must be PASS.
  2. Verify tab also accepts manual original + protected file pairs.
  3. Deploy smoke test: npx wrangler dev worker.protected.js then hit the worker; or paste the file into the Cloudflare dashboard module editor.

Limitations (by design)

  • The XOR key lives inside the file — this is obfuscation, not encryption. It stops casual skimming, grep-based tampering and bulk copy-paste, not a determined analyst.
  • Untouched by design: identifiers/property names, string property keys, string literals below min length, tagged templates, templates with ${...}, dynamic import() specifiers, module directives such as "use strict".
  • Output grows ~1.7-2.2x (hex) / ~1.4x (base64). Watch the size report against your Worker plan limit (free: 3 MB compressed, paid: 10 MB).

Inspect mode

Drop any file produced by this tool and it auto-locates the payload table and embedded key (no configuration) and recovers every stored string with its index — useful to check what got hidden, extract the key, or unlock maintenance. Use Export JSON to dump the full table.