Obfuscation Cheat Sheet

Replace meaningful variable/function names with short single-letter or hex-like names (a, b, _0x1234). The most common JS obfuscation technique.

Encode string literals using hex, Unicode escapes, Base64, or XOR cipher. Strings are decoded at runtime, hiding sensitive values from static analysis.

Inject unreachable or irrelevant code that never executes. Increases analysis effort without affecting runtime behavior.

Transform structured control flow (if/else, loops) into a flat switch-case dispatcher with state variable. Makes the code execution path extremely hard to follow statically.

Wrap code in eval(), new Function(), or setTimeout() with string arguments. The actual code is hidden as an encoded string that gets decoded and executed at runtime.

Check window.location.hostname at runtime and only execute on allowed domains. Prevents code from being copied and run on unauthorized sites.

Replace numeric literals with math expressions, hex, octal, binary, or bitwise operations that evaluate to the same value.

Add integrity checks that detect code modification or debugging. If tampering is detected, the code crashes, enters infinite loops, or produces incorrect results.

Replace characters with HTML entity references: decimal (A), hex (A), or named (&) entities.

Embed resources directly in HTML using data: URIs (Base64). Hides external resource references and makes content self-contained.

Encode JavaScript embedded in HTML using URL encoding, hex escapes, or character codes. Often used in obfuscated onclick, onload, or href attributes.

Replace meaningful CSS class names with short single/double-character names. Requires corresponding HTML class changes.

Convert CSS colors between formats: hex, rgb, hsl, or use complex rgba/hsla with transparency tricks. Colors can be represented in many equivalent ways.

Use CSS calc() with arithmetic expressions instead of fixed values. Combine with CSS variables for multiple layers of indirection.

Replace letters with visually similar numbers and symbols: e→3, a→4, s→5, t→7, o→0. Intensity ranges from basic to advanced.

Reverse alphabet substitution: A↔Z, B↔Y, C↔X. Self-reciprocal — applying it twice returns the original.

Standard Base64 with a shuffled 64-character alphabet. Cannot be decoded by standard Base64 decoders without knowing the custom alphabet.

Hide secret text as invisible zero-width Unicode characters (ZWSP, ZWNJ, ZWJ) embedded inside visible text. Completely invisible to readers.

Embed unique invisible fingerprints into text using zero-width characters. Generate multiple uniquely marked copies to trace leaks.

Move initial consonant cluster to end of word and add "ay". Words starting with vowels add "way" or "yay". Classic word game turned obfuscation.

Hide the final redirect destination using Base64 encoding, hash fragments, path encoding, ROT13, or split query parameters that combine to form the real URL.

Obfuscate query parameters by Base64 encoding values, hashing parameter names, shuffling order, and injecting fake decoy parameters.

Percent-encode parts of a URL to hide the actual characters. Double or triple encoding adds additional layers of obfuscation.

Hide messages in the least significant bits of pixel color values. Changes are imperceptible to the human eye but detectable statistically.

Scramble image colors by shuffling the color palette while preserving spatial structure. Deterministic seed allows lossless restoration.

Add Gaussian, uniform, or salt & pepper noise to obscure image details. Seed-based PRNG allows deterministic reversal.

Hide data in image EXIF metadata fields (comments, copyright, artist, etc.). Simple but effective — metadata is not visible in normal image viewing.

Encode binary data as Base64 text strings. The most common binary-to-text encoding, turning raw bytes into ASCII-safe characters.

XOR each byte with a key. Single-byte XOR is trivial to crack; multi-byte XOR keys are harder. XOR is reversible (same operation encrypts and decrypts).

Encode binary data as hexadecimal strings (0-9, a-f). Each byte becomes two hex characters.

Compress executables using packers like UPX. The compressed binary decompresses itself at runtime, hiding the original code.

Replace PHP variable names with short names. Preserves superglobals ($_GET, $POST, $this) and PHP keywords.

Encode PHP strings using hex escapes, base64_decode(), chr() concatenation, or XOR encryption. Strings are decoded at runtime.

Encode email addresses using HTML entities to hide from spam harvesters while remaining readable to users.

Apply ROT13 (shift letters by 13 positions) to email addresses. ROT13 is self-reciprocal.

Obfuscate bash commands using backtick substitution, environment variable manipulation, glob patterns, hex encoding, and ANSI-C quoting.

Replace bash variable names with short alternatives while preserving builtins (echo, cd, ls), special variables ($?, $@), and env vars (PATH, HOME).

Encode Python code as Base64 and execute with exec(). The encoded code is invisible in the source until decoded at runtime.

Compile Python code to bytecode objects and marshal them. The bytecode is executed directly, hiding the original source completely.

Encode Python strings using hex escapes, chr() concatenation, XOR byte arrays, or Base64. Decoded at runtime using utility functions.

ConfuserEx applies multiple protections: renaming, control flow, constants encryption, anti-debug, and anti-tamper. Very effective .NET protection.

ProGuard renames classes, methods, and fields to short meaningless names. Also removes unused code and inlines short methods.

Flatten Java control flow into a switch-based dispatcher. Transforms if/else, loops into a flat state machine.

Encode Go strings using byte slices, Base64 decoding, XOR byte arrays, hex escapes, or rune slices. Strings reconstructed at runtime.

Use Go build tags (//go:build, // +build) to conditionally include platform-specific code paths. Can hide platform-dependent obfuscation or logic.

Use Lua 5.2+ goto to flatten control flow into a dispatcher pattern. Transforms structured code into goto-based spaghetti.

Replace meaningful Lua local variable names, function parameters, and for-loop variables with short obfuscated identifiers.

Express colors using complex formulas: rgba(0,0,0,0) for transparent, overlapping gradients, or calc-based color channels.

Replace direct method calls with send() or public_send() using string arguments. Method names become runtime strings.

Wrap Ruby code in eval(), instance_eval(), or class_eval() with encoded string payloads. Base64 and nested encoding are common.