Control what changes
Choose a profile. Adjust transformations, VM settings and the names you need to keep.
Protect what
you create.
Make your source harder to analyze. Choose how it’s protected.
Built for your runtime.
- Lua 5.1–5.5
- LuaJIT 2.1
- Luau
- CfxLua core
Protection, on your terms.
Choose the protection your code needs. See what changes.
Source and settings, together
Work with your source, protection settings and build output in a single workspace.
Understand the result
See which transformations were applied, review warnings and compare output size.
From source to protection.
Read the quick start- 01
Add your source
Paste your code or open a source file.
- 02
Configure protection
Select your runtime, start with a profile and adjust individual settings.
- 03
Review your setup
Review your source, settings and processing availability before submitting.
Before you get started.
What does obfuscation protect against?
Obfuscation makes source harder to read and analyze. It is not encryption or an absolute barrier to reverse engineering. Keep secrets outside code you distribute.
When is my source uploaded?
Preparing a draft does not upload it. The workspace shows processing availability before you submit.
Start with your source.
Explore the workspace, or read the guide before choosing your settings.
Protection you can configure.
Profiles, transformations and runtime-specific controls, in one workspace.
Source editor
Paste a draft or open a UTF-8 file. Keep your source and settings side by side.
Protection profiles
Start with a profile, then adjust the settings your runtime supports.
Individual transformations
Eleven controls for renaming, literals, control flow and VM protection.
Build reports
Review applied changes, warnings and output size before testing your build.
Runtime support
Check target availability in the workspace and source compatibility in the build plan.
Lua 5.1, 5.2, 5.3, 5.4 and 5.5, LuaJIT 2.1, standalone Luau, and CfxLua core have distinct engine paths. The workspace identifies which are configured on your service.
| Runtime | VM selection |
|---|---|
| Lua 5.1 | Selected functions or whole script |
| Lua 5.2 | Selected functions or whole script |
| Lua 5.3 | Selected functions or whole script |
| Lua 5.4 | Selected functions or whole script |
| Lua 5.5 | Selected functions or whole script |
| LuaJIT 2.1 | Selected functions or whole script |
| Standalone Luau | Selected functions |
| CfxLua core | Source transforms only; no VM |
CfxLua core support does not qualify the FiveM host or its resource APIs. Standalone Luau is distinct from the blocked Roblox Creator Store profile.
Runtime limits and host compatibilityChoose your starting point.
The right protection depends on your code and runtime. Review and test each build.
Compatibility
Conservative transformations
Balanced
A practical starting point
Strong
Balanced transforms with annotated VM protection where supported.
Custom
Choose individual transforms and VM execution options for your runtime.
Advanced controls.
Explore the options available for your runtime.
Individual transformations
Keep a profile default, enable an eligible transformation, or require it. Required transformations fail closed when the source is ineligible.
- Identifier renaming
- String protection
- Control flow
- Internal fields
- Literal pooling
- Call indirection
- Function outlining
- Numeric literals
- Constant conditions
- Control-flow flattening
- Virtualization
Selective or whole-script VM
Select eligible functions, or a whole script on supported Lua and LuaJIT targets. Luau supports selective VM; CfxLua core has no VM. VM protection remains experimental.
- Whole-script selection
- Annotated functions only
- Yields
- Tail calls
- Register reuse
- Data-flow fusion
- Conditional fusion
- Allocation optimization
- Legacy metadata cache (Lua 5.1)
A separate function-name list selects native hot functions on supporting targets. Options vary by runtime; legacy metadata caching is Lua 5.1 only.
Macros and name preservation
Macros replace named constants with text, whole numbers or booleans before transformation. They are data substitutions, not a place for secrets.
Preserve globals, exact field names and license notices where supported. Luau exposes license-notice preservation only.
Read the macros guideMake it your own.
Choose your runtime and configure protection in the workspace.
Obfuscator
Your source, protection settings, and results in one place.
Sign in to protect your code
Sign inPrepare your source here. Sign in to preview and build.
Match the runtime that will execute your code. Disabled targets are not configured on this service.
Options inherit the selected profile until you override them. Check advanced-feature notes before enabling them.
Advanced protection
Use the profile default, apply a transform where supported, or require it. A required transform stops the build if it cannot be applied.
Rename local identifiers while preserving bindings.
Transform eligible string literals.
Restructure eligible control flow.
Transform statically resolved internal field names.
Share eligible literals through a generated pool.
Add indirection for eligible calls.
Outline eligible regions into functions.
Rewrite eligible numeric expressions.
Transform eligible constant conditions.
Experimental. Flatten eligible control-flow regions.
Virtualize supported functions. Eligibility, execution options and qualification depend on the target.
Drop a .lua, .luau or .txt file here, or choose a file. Maximum 1 MiB.
No file selectedOr paste your code below.
Your protected code appears here
Add source, choose your settings, and click Obfuscate code.
UTF-8 source, up to 1 MiB. Your source is processed on the server when you preview or obfuscate. Download your draft before closing this tab.
Build insights
Blog
Product updates and guides.
Administration
Manage your content, accounts, and site activity.
Projects
Organize projects and manage team access.
Build history
Review recent previews and builds.
Profile
Update your account details.
Billing
Buy usage tokens and review your organization's purchases.
Sign in
Enter your details to continue.
Create an account
You’ll verify your email next.
Check your email
Enter the code from your email.
Email confirmed
Your email is verified. Sign in to continue.
Email verification succeeded, but temporary session cleanup could not be confirmed. No browser sign-in was created.
Sign inForgot your password?
Request a code to recover access to your account.
Reset your password
Enter your reset code and choose a new password.
Dashboard
Protect your code and manage your projects.
Obfuscator
Upload source, configure protection, and download output.
Projects
Organize projects and manage team access.
Build history
Review recent previews and builds.
Profile
Update your account details.
Account security
Manage access on this browser or sign out of all GhostX Obfuscator sessions.
Opening your dashboard
Checking your session…
Keep your account protected.
Manage your authenticators and verify access to sensitive actions.
Security & privacy
Your source, account access and browser data.
Protected sessions
Your browser uses a protected session. Sign-in tokens stay encrypted on the server, outside page scripts.
Manage accountControl your access
Sign out of this browser, or end all your sessions from your account.
Browser storage
Your language and appearance preferences stay on this device and can sync to your account. Pending account actions save a reference so you can check their outcome. No analytics or third-party page scripts.
Server-side processing
Your source is transformed on the server without running it. Review the report, then test the output in your application.
Service status
See which services are available.
Connection check
Protection service
Checking…
Configuration
Account service
Checking…
A reachable service does not mean every engine target is configured. The workspace runtime selector reports current target availability.
Preferences
Manage appearance and language.
Appearance
Choose a light, dark, or system-matched workspace.
Language
Set the language used throughout the workspace.
Account & access
Manage your sign-in and active session from your account.
Privacy policy
How GhostX.group handles your information.
Public release details are pending: a verified contact email and final operator retention terms.
The operator
GhostX.group operates this preview. A verified privacy contact and final retention schedule must be configured before public launch. This notice describes the current implementation.
Source code and build results
Your draft stays in browser memory until you submit it. Opening a file does not upload it. Submitting a processing request sends source and settings to the backend. Protection does not execute your code. Stored uploads and results follow the configured retention policy; expiry alone does not confirm physical deletion. Authorized site owners may inspect retained result previews after a fresh security check and an audited authorization that records a reason. Downloaded files remain on your device until you remove them.
Account information
Signing in sends your email and password through the GhostX Obfuscator account server to Supabase Auth. GhostX Obfuscator stores account identifiers, encrypted provider tokens, session digests, and security metadata to authenticate requests and manage access. Passwords and provider tokens are not returned to the page.
Cookies and preferences
A necessary HttpOnly cookie maintains your signed-in session. Language, appearance, and sidebar preferences use local storage and may be saved to your account when signed in. This website has no analytics, advertising trackers, or third-party page scripts.
Service providers and retention
Supabase provides the hosted account database and authentication service. When enabled, Stripe processes one-time token purchases and monthly token refills on its hosted Checkout page, where payment details are entered. GhostX stores purchase references, payment status and token-ledger records. Account and session records remain subject to operator-managed retention; there is no published automatic account-deletion schedule yet. Build workspace cleanup is separate from account records. Public retention terms and applicable transfer information remain launch requirements.
Your choices
You can clear a draft, remove downloaded files, change browser preferences, and sign out locally or everywhere through your account. Clearing browser data does not delete hosted account records. Depending on applicable law, you may have rights to access, correct, delete, restrict, object to processing, or obtain a copy of personal data.
Contact and changes
GhostX.group is the operator. A verified privacy contact will be published before public release. Material changes to this notice will appear on this page.
Terms of use
The conditions for using GhostX Obfuscator.
Public release details are pending: a verified contact email and final operator retention terms.
About these terms
These preview terms describe GhostX Obfuscator, operated by GhostX.group. Public service terms, operator contact details, and any jurisdiction-specific conditions must be finalized before public release. Available purchases use Stripe Checkout when enabled on the service. The offers available to your account are shown on the billing page.
Your code and permissions
You retain your rights in the source you provide and the output produced from it, subject to the rights of others. Use GhostX Obfuscator only for code you own or are authorized to transform. You are responsible for complying with applicable licenses and distribution requirements.
What the service does
GhostX Obfuscator transforms source code on supported targets and provides plans, reports and output. Current targets cover Lua, LuaJIT, Luau and CfxLua core. Availability depends on the configured service; game hosts and distribution channels have separate restrictions. VM protection is experimental.
Review your results
Keep an original copy of your source and test generated output before distribution. Obfuscation raises the effort needed to understand code; it does not guarantee secrecy, prevent all reverse engineering, or replace access controls. Never embed credentials or other secrets in distributed code.
Account responsibilities
Keep account credentials private and use the session controls if access is compromised. Do not use another person’s account without authorization. Recovery and email-confirmation delivery remain subject to the published service availability.
Availability and changes
This version is in preview. Service availability depends on the deployment. Features may change as validation progresses. The status page identifies unavailable capabilities. Available purchases and processing are shown in your account. No uptime commitment is created by this preview.
Responsible use and contact
Follow the acceptable-use policy and applicable law. Do not disrupt the service, attempt unauthorized access, or use it to conceal harmful software. A verified operator contact must be published before the public service launches. Nothing here excludes rights that cannot lawfully be excluded.
Acceptable use
Use the tools responsibly. Respect other people’s code.
Public release details are pending: a verified contact email and final operator retention terms.
Permitted use
Use GhostX Obfuscator to protect code you own or are authorized to transform. Legitimate software protection, learning and authorized testing are within the intended scope.
Respect ownership
Do not misrepresent ownership, remove licensing obligations, distribute stolen source, or use obfuscation to conceal infringement. Protect only what you have the right to protect.
Do not harm people or systems
Do not use the service to conceal malware, credential theft, unauthorized surveillance, exploit delivery, or other harmful activity. Do not use generated code to gain unauthorized access or evade security controls on systems you do not own or administer.
Protect the service
Do not overload endpoints, bypass access or resource limits, probe accounts without authorization, or interfere with other users. Report suspected vulnerabilities responsibly without exposing another person’s data.
Enforcement and reporting
GhostX.group may restrict access to protect the service or comply with applicable law. A verified abuse and security reporting channel must be configured before public launch. Preserve only the minimum information needed to describe an issue; do not include secrets or another person’s source.
This page isn’t here.
The link may have changed. Head home or jump back into your workspace.