Lua Obfuscator

A lua obfuscator rewrites Lua source code into a form that is hard to read but behaves exactly like the original. Using a lua obfuscator online deters casual readers and copy-pasters from taking or modifying your scripts.

This tool applies these transformations:

• Local Variable Renaming: local variables, local functions, parameters and loop variables get short, meaningless names (e.g. _a, _b). Renaming follows Lua scoping, so globals, table fields and method names keep working.
• String Encoding: text strings become byte lists (e.g. "hello" becomes string.char(104,101,108,108,111)), or with the Strong level, entries in an encrypted pool decoded at run time, so they cannot be found with a text search.
• Comment Removal: comments that explain the code are stripped. Roblox --!strict, --!native and --!optimize directives at the top are kept.
• Whitespace Minification: indentation and line breaks are removed, so the script is one dense block.

Light is the fast, compact default. It stops casual reading, but deobfuscation tools can read it back quickly. Strong also encrypts every string with its own key into a pool that the script decodes when it runs, and hides whole numbers in arithmetic, so none of your text or constants appear in the file. Strong output is larger and starts slightly slower. Both levels use only standard Lua, so the output runs on Lua 5.1 to 5.4 and in Roblox Luau.

Modern Roblox code is understood: type annotations, type and export type aliases, generics, :: casts, if-then-else expressions, string interpolation, compound assignments such as +=, continue, and 0b or 1_000 numbers. Types are never changed, and variables inside interpolated strings are renamed along with the rest of the script.

When you obfuscate lua scripts you are not encrypting them: the result is ordinary Lua that any Lua VM runs immediately, and everything needed to run it is in the file. Obfuscation raises the effort needed to understand and copy your code; it cannot make reverse engineering impossible. Commercial virtual-machine obfuscators such as Luraph go further by compiling code to custom bytecode. Never put secrets such as API keys or passwords in client-side scripts, obfuscated or not.

1. Never Overwrite Originals: keep your clean, readable source code in a private version control system (e.g. Git). Obfuscated code is not meant to be maintained or debugged.
2. Test Obfuscated Builds: the transformations are designed and tested to keep behaviour identical, but always run your obfuscated scripts in a test environment before pushing them to production.
3. Keep Secrets on the Server: anything a client can run, a determined user can inspect. Validate important actions on the server instead of trusting client code.