JavaScript Obfuscator - VS Code Extension

Protect JavaScript files and selections with JavaScript Obfuscator directly from VS Code. Thin wrapper around the same HTTP API the jso-protector npm CLI uses, so the wire format and feature surface stay in lockstep.

Features

JSO: Obfuscate Current File - protect the whole open file. Result opens in a new untitled editor by default, or replaces the file in place if you prefer.
JSO: Obfuscate Selection - protect just the highlighted range and substitute it back.
JSO: Open Dashboard / JSO: Open Documentation - quick links to your account and the docs site.
Right-click integrations in the editor and the file explorer for .js, .jsx, .mjs, .cjs, .ts, and .tsx files.

Setup

Install the extension from the VS Code Marketplace.
Get an API key from https://javascriptobfuscator.com/Account.aspx#api (Basic tier or higher).
Add credentials. Two equivalent ways:

Settings UI (good for personal machines): Settings -> Extensions -> JavaScript Obfuscator -> fill jso.apiKey and jso.apiPassword.

Environment variables (recommended for shared machines):
```
export JSO_API_KEY="<base64-from-dashboard>"
export JSO_API_PASSWORD="<base64-from-dashboard>"
```
The extension reads JSO_API_KEY / JSO_API_PASSWORD (or the long-form JAVASCRIPT_OBFUSCATOR_API_KEY / JAVASCRIPT_OBFUSCATOR_API_PASSWORD) before falling back to settings.

Configuration

Setting	Default	Notes
`jso.endpoint`	`https://javascriptobfuscator.com/HttpApi.ashx`	Override only for self-hosted or staging endpoints.
`jso.preset`	`balanced`	One of `standard`, `balanced`, `maximum`.
`jso.openProtectedInNewEditor`	`true`	When false, replaces the file contents in place.
`jso.projectName`	`vscode-session`	Logged in the JSO audit history.
`jso.buildLabel`	``	Optional CI/CD label. Useful when you want to tie a one-off VS Code run to a branch or release.

Presets

Preset	Includes
`standard`	Core string encoding, string-array move, name mangling, compression.
`balanced`	+ string encryption, deep obfuscation, flat transform, code transposition.
`maximum`	+ member rename, global rename, member move, dead-code insertion.

For fine-grained control, run obfuscation from the npm CLI with a full jso.config.json.

Security

API credentials are read from environment variables first, settings second. They are never logged.
Requests go directly from your editor to HttpApi.ashx over HTTPS. No third party intercepts the source.
Source code leaves your machine only when you run an obfuscate command. Nothing is sent on extension activation.

Privacy

The extension does not send telemetry. Each obfuscate command sends exactly one POST to the endpoint above. The JSO dashboard logs request metadata (project name, build label, file count, timestamp) - see the JSO privacy policy for retention windows.

Reporting issues

Open an issue at https://javascriptobfuscator.com/contact.aspx. Include the VS Code version and the JSO: error message.

License

UNLICENSED. The extension is provided as a free companion to the JavaScript Obfuscator service; an active JSO account is required to make API calls.

JavaScript Obfuscator

cutesoft_components