Code Shredder

Obfuscate your built JavaScript to make it harder to read — right from VS Code. Right-click a build folder, pick a strength, done. Originals are backed up automatically.

Read this first: obfuscation makes code harder to read, not secure. See the tested limitations below before relying on it.

What it does

Code Shredder takes readable JavaScript like this:

const secret = 42;
function greet(name) {
  return "hello " + name + ", code is " + secret;
}

…and turns it into this:

const _0x2dee35=_0x52b1;(function(_0x5033c6,_0x51c29d){const _0x2a026c=_0x52b1...

The code still runs exactly the same — it's just harder for a human to read at a glance. It renames local variables, encodes some strings, and tangles control flow.

Install

code --install-extension code-shredder-0.0.3.vsix

Or search "Code Shredder" in the Extensions panel (Open VSX / Cursor, or the VS Code Marketplace).

Then reload: Cmd/Ctrl + Shift + P → Reload Window.

How to use

1. Build your project first. Code Shredder runs on built output (a dist or build folder), never your source.
2. In the Explorer, right-click the build folder.
3. Click Code Shredder: Obfuscate this folder.
4. A success message confirms how many files were shredded.

Auto-shred on every build (optional)

Right-click your project folder → Code Shredder: Set up auto-shred on build. For Vite / Create React App projects this adds a postbuild hook so every npm run build obfuscates automatically. (Next.js needs a next.config.js webpack edit instead — the command will tell you.)

Strength levels

Set in Settings → Code Shredder → Level:

Backups

Every run copies originals to <folder>/.shredder-backup/<timestamp>/ before obfuscating. To restore, copy them back. The backup folder is skipped on future runs.

⚠️ Tested limitations — read this

Obfuscation is a speed bump, not security. We tested the output against webcrack, a free automated de-obfuscator:

A free tool, run in seconds, fully recovered API keys, license strings, function names, and the complete program logic from both levels. Only local variable names stayed scrambled.

What this means:

• ❌ Does not protect secrets — API keys, passwords, license checks come right back out.
• ❌ Max level barely out-resists an automated cracker vs. balanced — just bigger and slower.
• ✅ Does stop casual copy-paste and make lazy snooping annoying.

The real rule: anything that must stay secret belongs server-side, behind an API — never shipped to the browser, obfuscated or not. Use Code Shredder to raise the effort for casual readers, not to secure anything that matters.

Not for:

• Secrets of any kind in client code.
• Server code — it's already private; obfuscating adds cost and bugs for nothing.
• Flutter — use flutter build --obfuscate --split-debug-info=... instead.

Troubleshooting

• "No .js files found" — build first; you're pointing at source.
• Command missing on right-click — it only appears on folders, not files.
• Restricted Mode banner — click Manage → Trust so extensions can run.

License

MIT.