JSGuardian Docs

Upload your .js file at /protect, select a preset, click Protect.
Your protected file is ready in seconds.

CLI (coming soon):
  npx jsguardian protect app.js  # maximum protection by default

Node.js API / MCP: see the API & MCP page →

Every time you protect a file — even the same file twice — JSGuardian generates a completely unique output.

This is not an accident. It’s a core security property.

Here’s what changes on every run:
  • A cryptographic random seed drives the entire transformation
  • The runtime internals are unique per build — no two outputs are the same
  • The runtime engine is proprietary — its internals are intentionally undisclosed
  • Rolling encryption keys are unique per build
  • String cipher keys are re-derived each time
  • All obfuscation constants are re-generated

What this means in practice:
  • An attacker cannot compare two builds of your software to reverse-engineer patterns
  • Analysis tools trained on one build are useless against the next
  • Even if one build is partially understood, every other version is a fresh problem
  • No two customers who buy the same product share the same protection fingerprint

If you protect 10 identical files at once, you get 10 completely different outputs.
Each one runs identically to the original — but they look like different programs.

Obscure  — Core obfuscation. Constants unfoldable, strings encrypted, runtime keys.
Deceive  — Full misdirection stack. Sealed runtime, deception output, daily-rotating protection.
Maximum  — Every technique active. Ghost trail injection, context window flooding, all 13 layers.
Stealth  — Same as Maximum. No copyright markers. Indistinguishable from unlicensed JS.

Core Protection (6 techniques) — Available on all plans
  Makes your code unreadable. Constants become complex expressions.
  Strings are encrypted. Decryption keys exist only at runtime.
  Any file modification breaks the integrity chain silently.

Active Misdirection (7 techniques) — KB Pack & above
  Your code actively lies. Analysts extract a convincing wrong answer.
  Protection changes daily without redeploying.
  Sandbox environments silently receive wrong results.

AI-Specific Resistance (7 techniques) — Deceive & above
  Engineered specifically to defeat AI-assisted reverse engineering.
  Exhausts AI context windows. Triggers security-tool refusal.
  Keys derived from conditions AI sandboxes cannot replicate.

Input:   .js files (Node.js CommonJS) or .zip archives
Output:  .protected.js files — individually or as .zip
Runtime: Node.js CJS — fully require()-able
TTL:     Files stored per your plan (Free: 1d, Pack: 3d, Pro: 90d, Fortress: 180d)

Protected code:
  • Runs identically to the original for all inputs
  • No external dependencies added
  • No performance overhead at runtime (protection is static)
  • require() it exactly as you would the original

REST API: POST /api/v1/protect (Fortress plan)
  Authorization: Bearer jsg_live_...
  Body: { code, preset, filename }
  Response: { code, protectedSize, originalSize, downloadUrl }

MCP Server: @jsguardian/mcp (Fortress plan)
  Works in Claude Code, Cursor, Continue.dev
  Generates API keys from your account dashboard
  See the MCP page for setup instructions →

JSGuardian is evaluated with a 12-axis matrix on every major change:
  • Correctness, long-running stability & cross-build usability
  • Cold-start, warm execution & memory characteristics
  • Environmental sensitivity (D-oracles) + receipt / PCET chain integrity
  • Surface quality, branding removal, and per-build polymorphism
  • Adversarial resistance under isolated blind reconstruction (LLM+IR)

Current results on maximum + full A–H: overall ~6, nameRecovery 0.00, crossRefScore 0.00.

Full analysis, charts, size/performance tables and category breakdowns → /tests