Pricing

Beep.dev Pricing

Pick the plan that fits your project.

One obfuscator for 18 languages

Most obfuscators are language-specific — one tool for .NET, another for Java, another for JavaScript, another for C/C++. PolyShield covers Rust, C, C++, Python, Lua, Luau, JavaScript, TypeScript, C#, Java, Go, Swift, Kotlin, Dart, Objective-C, x86-64 assembly, PHP, and HTML through one CLI, one GUI, and one config file — a real answer to a real fragmentation problem, not a feature-list bullet. (HTML gets structural cleanup rather than full obfuscation, and Luau — Roblox's Lua dialect — is the newest addition, still bootstrap-scope; see the methodology notes below.)

Doesn't break your build

Every rename and every transform is built around one rule: never touch anything unless it's provably safe, and reparse (often recompile and run) the result before trusting it. Full breakdown and real numbers just below.

Goes past source-level obfuscation

For Lua, Python, and JavaScript, PolyShield can compile the already-obfuscated file to real bytecode, encrypt it, and ship a small loader stub instead — the file on disk is never valid source at all, not just hard-to-read source.

Every build traces back to the license that made it

Watermarking is on by default — the license key is folded into the seed behind every generated name, so a leaked build can be matched back to whoever leaked it, with no effect on what actually gets obfuscated.

Measured performance impact

We publish real before/after build-time and runtime numbers per language instead of asking you to take our word for it — Rust and C++ show near-zero overhead once the compiler's optimizer runs; see the honest, interpreted-language worst case too.

Real before/after examples

No stock screenshots — see actual obfuscated output generated by this CLI below, for code you can read line by line.

Four protection tiers, not one setting

Every tier composes with the ones before it — pick how far up the stack your project actually needs to go.

Rename & cleanup

Functions, classes, variables, and parameters renamed wherever it's provably safe; comments stripped, imports sorted, whitespace compressed.

String encryption

Plain string literals XOR-encoded behind a generated per-file decoder — a plain strings/grep turns up nothing readable.

Control-flow obfuscation

Flatten (dispatcher-loop + state machine), opaque predicates (always-true conditions built from math identities, not assumptions), and dead-code injection hide a function's real shape.

Bytecode VM

A function's body compiled into a custom instruction set, executed by a generated interpreter — full virtualization for dynamic languages, int/double-scoped for typed ones.

Compiled bytecode + encrypted loader

Lua, Python, and JavaScript go one step further: the fully-transformed file is compiled to real bytecode, encrypted, and replaced by a small decrypt-and-run loader stub — never valid source on disk at all.

Anti-debug & integrity checks

An optional runtime check for an attached debugger (16 of 17 non-markup languages), plus tamper detection for Python/PHP/JavaScript/Lua/Dart — the file checksums itself at startup and refuses to run if it's been patched.

Mixed Boolean-Arithmetic obfuscation (rewriting arithmetic into equivalent but far less obvious bitwise/boolean expressions) is available as an opt-in add-on across nearly every language here too. None of tiers 2 through 6 are forced on by default — mode = "hardened" turns on everything implemented for your project; lighter combinations are just a config flag away.

PolyShield benchmarks — all 16 obfuscatable languages

Before/after code and compile/run timings, generated on this machine with PolyShield's own CLI — not mockups. Same four numbers wherever a real toolchain made them measurable: original vs. obfuscated source, obfuscation time, build-time impact, and runtime impact. Where a number genuinely couldn't be measured in this environment, it's labeled "not measured," never guessed.

Rust

rename flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size 1,023 B → 9,441 B 9.2×

Obfuscation time 25 ms

Build time (rustc -O) 190 ms → 200 ms ~+5%

Runtime (3M-limit prime count) 406 ms → 409 ms ~+0.6%

                      
                      original — classify.rs
                    
fn classify(n: i64) -> &'static str {
    if n < 0 {
        "negative"
    } else if n == 0 {
        "zero"
    } else if n % 2 == 0 {
        "even"
    } else {
        "odd"
    }
}

                      
                      obfuscated (excerpt, 129 lines total)
                    
fn classify(n: i64) -> &'static str {
    if !(((941i64 + 220i64) * (941i64 + 220i64))
        == ((941i64 * 941i64) + (2i64 * 941i64 * 220i64) + (220i64 * 220i64)))
    {
        for __shield_junk_i in 0i64..19i64 {
            let _ = __shield_junk_i;
        }
    }
    let mut __shield_state_OKL7XK: i64 = 0;
    if (319i64 * 319i64) >= 0i64 {
        loop {
            if !(((189i64 + 56i64) * (189i64 + 56i64))
                == ((189i64 * 189i64) + (2i64 * 189i64 * 56i64) + (56i64 * 56i64)))
            {
                let __shield_junk = 9i64 * 2i64 + 1i64;
                let _ = __shield_junk;
            }
            match __shield_state_OKL7XK {
                1 => {
                    if !(((329i64 * 329i64) - (531i64 * 531i64))
                        == ((329i64 - 531i64) * (329i64 + 531i64)))
                    {
                        if 38i64 > 0i64 {
                            let __shield_junk = 38i64 - 1i64;
                            let _ = __shield_junk;
                        }
                    }
                    break;
                }
                2 => {
                    return "negative";
                }
                4 => { /* … */ }
                5 => {
                    return "zero";
                }
                /* … dispatcher continues for the "even"/"odd" arms … */
                _ => unreachable!(),
            }
        }
    }
    unreachable!()
}

Control-flow flattening turns the if/else‑if chain into a dispatcher loop; every branch condition also gets wrapped in a seed‑derived algebraic identity (opaque_predicates) plus unreachable junk arithmetic (dead_code_injection). rustc's own optimizer folds most of it back out at -O, which is exactly why the compiled binary's runtime barely moves.

C++

rename flatten_control_flow opaque_predicates dead_code_injection mba_obfuscation

Source size 1,373 B → 5,816 B 4.2×

Obfuscation time 34 ms

Build time (MSVC /O2) 1.49 s → 1.48 s no change

Runtime (3M-limit prime count) 471.8 ms → 472.0 ms no change

                      
                      original — classify.cpp
                    
const char* classify(int64_t n) {
    if (n < 0) {
        return "negative";
    } else if (n == 0) {
        return "zero";
    } else if (n % 2 == 0) {
        return "even";
    } else {
        return "odd";
    }
}

                      
                      obfuscated (excerpt, 88 lines total)
                    
const char* QRPB(int64_t G5J60G) {
if (!(((971 % 2 == 0) || (971 % 2 == 1)))) {
int SPOEJ = 971;
if (SPOEJ > 0) {
SPOEJ = ((SPOEJ) | (35)) + ((SPOEJ) & (35));
}
}
int UEXZU3 = 7;
if (!(((623 * 623) - (953 * 953)) == ((((623) ^ (953)) - (((~(623)) & (953)) << 1)) * (((623) | (953)) + ((623) & (953)))))) {
int Y2RG7I = 623;
if (Y2RG7I > 0) {
Y2RG7I = ((Y2RG7I) | (953)) + ((Y2RG7I) & (953));
}
}
while (true) {
if (((((129) ^ (148)) + (((129) & (148)) << 1)) * (((129) | (148)) + ((129) & (148)))) == ((129 * 129) + (2 * 129 * 148) + (148 * 148))) {
switch (UEXZU3) {
case 0:
goto PUU1HJ;
case 1:
return "negative";
case 2:
return "zero";
case 3:
return "even";
/* … dispatcher continues … */
}
}
}
PUU1HJ:
return "odd";
}

C++ is the only plugin with Mixed Boolean-Arithmetic (MBA) rewriting today — plain integer +/-/&/|/^ get replaced with provably-equivalent bitwise identities (visible above: ((a)|(b))+((a)&(b)) in place of a+b). Like Rust, MSVC's optimizer absorbs almost all of it at /O2.

JavaScript

rename flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings bytecode_vm anti_debug

Source size 886 B → 17,806 B 20.1×

Obfuscation time 250 ms

Build time impact N/A — interpreted, no build step

Runtime (3M-limit prime count) 1,141 ms → 171,663 ms ~150×

                      
                      original — classify.js
                    
function classify(n) {
  if (n < 0) {
    return "negative";
  } else if (n === 0) {
    return "zero";
  } else if (n % 2 === 0) {
    return "even";
  } else {
    return "odd";
  }
}

                      
                      obfuscated (excerpt, 1 line / 17.8 KB total)
                    
function XHXUQS(bytes) {
    var key = [98,2,255,134,219,207,174,99,56,94,149,110,75,84,149,50];
    var out = new Uint8Array(bytes.length);
    for (var i = 0; i < bytes.length; i++) {
        out[i] = bytes[i] ^ key[i % key.length];
    }
    return new TextDecoder().decode(out);
}

const N6JE6S = [{k:[2,663,0,1,false,981,798,...],
  c:[{o:"MOV",d:1,s:0},{o:"LDK",d:2,k:0},{o:"CMP",op:"<",d:3,a:1,b:2},
     {o:"JIN",c:3,t:22}, /* … 120 more instructions … */ ]}];

function HC1J(protos, pidx, penv, args, G) {
  // shared register-based interpreter: LDK/MOV/AR/CMP/JMP/JIF/JIN/CALL/RET/CLOS
  var proto = protos[pidx]; var R = args.slice(); var ENV = [R];
  /* … dispatch loop over the bytecode array above … */
}

function D86M6N(UV2Q) { // was classify()
  return HC1J(N6JE6S, 0, null, Array.prototype.slice.call(arguments), null);
}

Every string literal is XOR-encoded, and classify itself no longer exists as readable JS at all — it's compiled to a flat bytecode array executed by a shared, generated interpreter (bytecode_vm, this codebase's JS "hero feature"). That's also why the runtime number above jumps so much: interpreting every arithmetic op/branch through a dispatch loop — and here, countPrimes calling isPrime means one virtualized function interpreting another, nested — has real, honest cost. Renaming + control-flow + string encryption alone (no VM) previously measured near-zero overhead on this exact workload; this ~150× reflects bytecode_vm specifically, isolated to its own pill so you can decide if that trade-off is worth it for the function(s) that actually need it.

Python

rename (heuristic) flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size 841 B → 8,022 B 9.5×

Obfuscation time 33 ms

Build time impact N/A — interpreted, no build step

Runtime (300K-limit prime count) 661 ms → 1,184 ms ~+79%

                      
                      original — classify.py
                    
def classify(n):
    if n < 0:
        return "negative"
    elif n == 0:
        return "zero"
    elif n % 2 == 0:
        return "even"
    else:
        return "odd"

                      
                      obfuscated (excerpt, 101 lines total)
                    
def PELG38(byte_list):
    key = [229,114,223,248,35,4,112,11,133,106,85,90,195,164,85,141]
    decoded = bytes(b ^ key[i % len(key)] for i, b in enumerate(byte_list))
    return decoded.decode("utf-8")

def classify(n):
    if not (((35 + 422) * (35 + 422)) == ((35 * 35) + (2 * 35 * 422) + (422 * 422))):
        Z0O6 = 35
        if Z0O6 > 0:
            Z0O6 = Z0O6 + 422
    if ((719 + 426) * (719 + 426)) == ((719 * 719) + (2 * 719 * 426) + (426 * 426)):
        NJ9RD8 = 7
    while NJ9RD8 != -1:
        if NJ9RD8 == 0:
            NJ9RD8 = -1
        elif NJ9RD8 == 1:
            if ((241 * 241) - (355 * 355)) == ((241 - 355) * (241 + 355)):
                return PELG38([139,23,184,153,87,109,6,110])  # "negative"
        elif NJ9RD8 == 2:
            if ((245 % 2 == 0) or (245 % 2 == 1)):
                return PELG38([159,23,173,151])  # "zero"
        # … dispatcher continues for "even"/"odd" …

Python is the honest worst case here: CPython has no JIT to fold the extra branches/arithmetic back out, so the +79% runtime hit above is real, not a rounding error. It's also why python_heuristic_rename is opt-in and off by default — see the methodology note below.

C

flatten_control_flow opaque_predicates dead_code_injection mba_obfuscation

Source size1,290 B → 4,283 B 3.3×

Obfuscation time27 ms

Build time (MSVC /O2)1.33 s → 1.33 s no change

Runtime468 ms → 468 ms no change

original — classify.c
const char* classify(int64_t n) {
    if (n < 0) {
        return "negative";
    } else if (n == 0) {
        return "zero";
    } else if (n % 2 == 0) {
        return "even";
    } else {
        return "odd";
    }
}

obfuscated (excerpt, 216 lines total)
const char* classify(int64_t n) {
int ADSZ5P = 7;
while (1) {
if (((755 * 755) - (249 * 249)) == ((755 - 249) * (755 + 249))) {
if (!(((437 * 437) - (255 * 255)) == ((437 - 255) * (437 + 255)))) {
for (int WUWC = 0; WUWC < 437; WUWC++) {}
}
switch (ADSZ5P) {
case 0:
goto J96D7;

case 1:
return "negative";

case 2:
return "zero";
/* … dispatcher continues, plus MBA-rewritten arithmetic elsewhere in the file … */

C's rename pass only touches static free functions (real internal linkage) — this sample's functions aren't static, so their names survive untouched here on purpose. Everything else (flatten, opaque predicates, dead code, and C++'s own MBA rewriting ported almost directly) still applies.

C#

flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size1,514 B → 7,380 B 4.9×

Obfuscation time50 ms

Build time (dotnet build)1.05 s → 1.21 s ~+15%*

Runtime708 ms → 732 ms ~+3%

original — Classify.cs
static string Classify(long n)
{
    if (n < 0) { return "negative"; }
    else if (n == 0) { return "zero"; }
    else if (n % 2 == 0) { return "even"; }
    else { return "odd"; }
}

obfuscated (excerpt, 264 lines total)
static string Classify(long n)
{
if (!(((31 * 31) - (697 * 697)) == ((31 - 697) * (31 + 697)))) {
for (long JPL1 = 0; JPL1 < 31; JPL1++) {}
}
long __shieldStateX3H7Z = 0;
while (true) {
switch (__shieldStateX3H7Z) {
case 1:
{
__shieldStateX3H7Z = -1;
}
continue;
case 2:
{
return global::UO34H.Decode(new byte[] { 12, 103, 152, 231, 175, 166, 216, 6 });
}
/* … dispatcher continues … */

C# has no rename pass yet (no per-file privacy boundary exists to prove a top-level name is safe to rename — see the methodology note), but every string, including each return value, is still XOR-encoded behind a generated decoder. *Build-time delta here is close to MSBuild's own run-to-run noise floor.

Java

flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size1,426 B → 8,236 B 5.8×

Obfuscation time42 ms

Build time (javac)0.42 s → 0.46 s ~+11%*

Runtime474 ms → 475 ms no change

original — Main.java
static String classify(long n) {
    if (n < 0) { return "negative"; }
    else if (n == 0) { return "zero"; }
    else if (n % 2 == 0) { return "even"; }
    else { return "odd"; }
}

obfuscated (excerpt, 244 lines total)
static String classify(long n) {
int __shieldStateN361 = 0;
while (true) {
switch (__shieldStateN361) {
case 1:
{
__shieldStateN361 = -1;
}
continue;
case 2:
{
return ERBLH1.decode(new byte[] { (byte)12, (byte)103, (byte)152, (byte)231, (byte)175, (byte)166, (byte)216, (byte)6 });
}
case 4:
{
if (!(((759 + 526) * (759 + 526)) == ((759 * 759) + (2 * 759 * 526) + (526 * 526)))) {
int M8P9 = 759;
if (M8P9 > 0) { M8P9 = M8P9 + 526; }
}
__shieldStateN361 = 1;
}
continue;
/* … dispatcher continues … */

Same story as C# — no rename pass yet (package-private isn't a per-file boundary either), full flatten/opaque/dead-code/string-encryption otherwise. *Build-time delta here is close to javac's own run-to-run noise floor.

Go

flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size942 B → 6,224 B 6.6×

Obfuscation time36 ms

Build timeN/A — measured via go run, combined compile+execute

Runtime~478 ms → ~478 ms no change

original — classify.go
func classify(n int64) string {
	if n < 0 {
		return "negative"
	} else if n == 0 {
		return "zero"
	} else if n%2 == 0 {
		return "even"
	} else {
		return "odd"
	}
}

obfuscated (excerpt, 287 lines total)
func classify(n int64) string {
if !(((883 * 883) - (73 * 73)) == ((883 - 73) * (883 + 73))) {
for UC5TGP := 0; UC5TGP < 883; UC5TGP++ {
}
}
__shieldStateR982 := 0
for {
switch __shieldStateR982 {
case 1:
{
__shieldStateR982 = -1
}
continue
case 2:
{
return __shieldDecoderT226I([]byte{ 12, 103, 152, 231, 175, 166, 216, 6 })
}
/* … dispatcher continues … */

No rename pass here either (Go's "unexported" is package-wide, not file-local), but flatten/opaque/dead-code/string-encryption are all real and all fired here.

Swift

flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size1,065 B → 6,535 B 6.1×

Obfuscation time40 ms

Build time (swiftc -O)1.35 s → 1.85 s ~+37%*

Runtime404.5 ms → 406.3 ms no change

original — classify.swift
func classify(_ n: Int) -> String {
    if n < 0 { return "negative" }
    else if n == 0 { return "zero" }
    else if n % 2 == 0 { return "even" }
    else { return "odd" }
}

obfuscated (excerpt, 239 lines total)
func classify(_ n: Int) -> String {
if !(((655 * 655) - (433 * 433)) == ((655 - 433) * (655 + 433))) {
for K29B in 0..<655 { _ = K29B }
}
var __shieldStateAOU15K = 0
while true {
switch __shieldStateAOU15K {
case 1:
__shieldStateAOU15K = -1
continue
case 2:
return __shieldDecoderU6Z1AN([12, 103, 152, 231, 175, 166, 216, 6])
/* … dispatcher continues … */

Swift is the plugin CLAUDE.md's own notes flag as best-positioned for a future rename pass (it has a real file-private access level, fileprivate) — just not implemented yet. *The build-time delta is dominated by swiftc's own module-cache warm-up variance, not the transform itself.

TypeScript

rename flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings bytecode_vm anti_debug

Source size970 B → 13,762 B 14.2×

Obfuscation time210 ms

Build time (tsc)0.55 s → 0.48 s no change

Runtime (3M-limit prime count)463 ms → 107,161 ms ~231×

original — classify.ts
function classify(n: number): string {
  if (n < 0) { return "negative"; }
  else if (n === 0) { return "zero"; }
  else if (n % 2 === 0) { return "even"; }
  else { return "odd"; }
}

obfuscated (excerpt, 1 line / 13.8 KB total)
function DLQR(bytes: number[]): string {
    const key = [98,2,255,134,219,207,174,99,56,94,149,110,75,84,149,50];
    const out = new Uint8Array(bytes.length);
    for (let i = 0; i < bytes.length; i++) {
        out[i] = bytes[i] ^ key[i % key.length];
    }
    return new TextDecoder().decode(out);
}

const N6JE6S = [{k:[2,663,0,1,false,...],
  c:[{o:"MOV",d:1,s:0},{o:"LDK",d:2,k:0}, /* … 120 more instructions … */ ]}];

function HC1J(protos, pidx, penv, args, G) {
  // shared register-based interpreter — same design as the JS demo's VM
  /* … dispatch loop over the bytecode array above … */
}

function D86M6N(UV2Q: number): string { // was classify()
  return HC1J(N6JE6S, 0, null, Array.prototype.slice.call(arguments), null);
}

TypeScript shares JavaScript's exact module-privacy model, so it gets a real rename pass from day one, plus the same bytecode_vm/anti_debug passes as JavaScript now that both are wired up for TS too. Same story as the JS card: the ~231× runtime cost is bytecode_vm specifically (a nested interpreter call per prime check), not hardened mode as a whole — tsc's own build time barely moves, since it's just compiling more (still perfectly valid) generated TypeScript.

Dart

flatten_control_flow opaque_predicates dead_code_injection

Source size996 B → 1,950 B 2.0×

Obfuscation time4 ms

Build timeN/A — measured via dart run, JIT, no separate build step

Runtime444 ms → 443 ms no change

original — classify.dart
String classify(int n) {
  if (n < 0) { return "negative"; }
  else if (n == 0) { return "zero"; }
  else if (n % 2 == 0) { return "even"; }
  else { return "odd"; }
}

obfuscated (excerpt, 116 lines total)
String classify(int n) {
int L6HYI = 7;
while (true) {
switch (L6HYI) {
case 0:
throw Exception("unreachable");
case 1:
return "negative";
case 2:
return "zero";
case 3:
return "even";
case 4:
return "odd";
case 5:
if (n % 2 == 0) {
L6HYI = 3;
} else {
L6HYI = 4;
}
break;
/* … dispatcher continues … */

Dart's rename pass is scoped to _-prefixed library-private classes/enums, and obfuscate_strings is still deferred — neither applies to this plain-function sample, so what you see here is flatten + opaque predicates + dead code only, honestly reflected in the smaller 2.0× growth.

PHP

flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size1,018 B → 3,802 B 3.7×

Obfuscation time30 ms

Build timeN/A — interpreted, no build step

Runtime262 ms → 272 ms ~+4%

original — classify.php
function classify($n) {
    if ($n < 0) { return "negative"; }
    elseif ($n === 0) { return "zero"; }
    elseif ($n % 2 === 0) { return "even"; }
    else { return "odd"; }
}

obfuscated (excerpt, 183 lines total)
function MPI17($bytes) {
    $key = [98,2,255,134];
    $out = '';
    $n = count($key);
    for ($i = 0; $i < count($bytes); $i++) {
        $out .= chr($bytes[$i] ^ $key[$i % $n]);
    }
    return $out;
}

function classify($n) {
$XXCY = 7;
if (((799 * 799) >= 0)) {
while (true) {
if ($XXCY === 0) {
break;
} elseif ($XXCY === 1) {
return MPI17([12,103,152,231,22,107,137,227]);
/* … dispatcher continues … */

PHP's rename pass is scoped to private class methods — this top-level function isn't one, so its name survives, but PHP's own flatten/opaque_predicates turned out to be some of the SIMPLEST implementations in the whole codebase, since PHP has no block scoping and no static "missing return" checker to design around.

x86-64 Assembly

rename flatten_control_flow opaque_predicates dead_code_injection

Source size811 B → 4,170 B 5.1×

Obfuscation time20 ms

Build time (nasm + link)1.40 s → 1.39 s no change

Correctnessexit code 6 → 6 exact match

original — classify.asm
classify:
    cmp rcx, 0
    jl .is_negative
    jz .is_zero
    test rcx, 1
    jnz .is_odd
.is_even:
    mov eax, 2
    ret
.is_odd:
    mov eax, 3
    ret
.is_negative:
    mov eax, 0
    ret
.is_zero:
    mov eax, 1
    ret

obfuscated (excerpt, 396 lines total)
RSJS8:                  ; was classify
    cmp rcx, 0
    push r10
    pushfq
    mov r10, 95
    sub r10, 95
    je near .BULFX        ; always taken — seed-derived identity
    jmp near .BCH4F
.BCH4F:
.BULFX:
    popfq
    pop r10
    jl .KJMZS              ; renamed .is_negative
    push r10
    pushfq
    mov r10, 341
    xor r10, 341
    je near .V4MC3U
    jmp near .WY7YHI
; … opaque predicates + dead-code decoys interleaved through
; every real branch below, all as dot-local labels …

Full transparency, updated: an earlier version of this page reported real bugs in flatten_control_flow/opaque_predicates — output a real NASM assembler rejected for this exact sample. Both are now fixed (the root cause was NASM's local-label scoping: a decoy's own label has to be dot-local too, or it silently resets which function a later .label reference resolves against) and verified by actually assembling, linking, and running both versions on real NASM/MSVC and diffing the real process exit code — this demo now shows the complete pipeline instead of a scoped-down one.

Kotlin

flatten_control_flow opaque_predicates dead_code_injection

Source size1,124 B → 3,472 B 3.1×

Obfuscation time20 ms

Build/runtime impactNot measured — no usable kotlinc CLI in this environment

original — classify.kt
fun classify(n: Long): String {
    if (n < 0) { return "negative" }
    else if (n == 0L) { return "zero" }
    else if (n % 2 == 0L) { return "even" }
    else { return "odd" }
}

obfuscated (excerpt, 190 lines total)
fun classify(n: Long): String {
var CDJZ1 = 7
if (!(((655 + 490) * (655 + 490)) == ((655 * 655) + (2 * 655 * 490) + (490 * 490)))) {
for (A3G67 in 0 until 655) {}
}
if (((641 * 641) >= 0)) {
while (true) {
when (CDJZ1) {
0 -> {
break
}
1 -> {
return "negative"
}
2 -> {
return "zero"
}
/* … dispatcher continues … */

Kotlin's rename pass only reaches explicit top-level private declarations — this function isn't marked private, so it's untouched here, but the when-based dispatcher, opaque predicates, and dead code are all real, verified output. We didn't fabricate build/run numbers just because the toolchain wasn't handy — see the methodology note.

Lua

flatten_control_flow opaque_predicates dead_code_injection obfuscate_strings

Source size1,014 B → 15,671 B 15.5×

Obfuscation time81 ms

Build/runtime impactNot measured — no standalone Lua interpreter in this environment

original — classify.lua
function classify(n)
    if n < 0 then
        return "negative"
    elseif n == 0 then
        return "zero"
    elseif n % 2 == 0 then
        return "even"
    else
        return "odd"
    end
end

obfuscated (excerpt, 300 lines total)
local function O5ETUZ(protos, proto_idx, parent_env, nargs, ...)
    local pack = table.pack or function(...) return {n = select('#', ...), ...} end
    local unpack = table.unpack or unpack
    local proto = protos[proto_idx]
    local R = {}
    local env = {R}
    if parent_env then
        for i = 1, #parent_env do
            env[i + 1] = parent_env[i]
        end
    end
    for i = 1, proto.np do
        R[i] = (select(i, ...))
    end
    local code = proto.code
    local K = proto.k
    local pc = 1
    while true do
        local ins = code[pc]
        local op = ins.op
        if op == "LOADK" then
            R[ins.d] = K[ins.k]
        /* … a full generated bytecode interpreter, then classify itself compiles to data … */

Lua's own hero feature — bytecode_vm — clearly fired here: the whole function compiles down to a custom instruction array executed by a generated interpreter embedded right in the file, which is why this is the largest size increase of any language in this table (15.5×). This one genuinely needs a real Lua interpreter to verify execution, which isn't available on this machine — flagged honestly rather than skipped or faked.

Objective-C

flatten_control_flow opaque_predicates

Source size621 B → 945 B 1.5×

Obfuscation time3 ms

Build/runtime impactNot measured — no Objective-C compiler exists on this machine at all

original — Calculator.m
- (int)classify:(long)n {
    if (n < 0) { return 0; }
    else if (n == 0) { return 1; }
    else if (n % 2 == 0) { return 2; }
    else { return 3; }
}

obfuscated (full method, 74 lines total)
- (int)classify:(long)n {
if (!(((339 + 190) * (339 + 190)) == ((339 * 339) + (2 * 339 * 190) + (190 * 190)))) {
int E8I0 = 339;
if (E8I0 > 0) {
E8I0 = E8I0 + 190;
}
}
int MOPF = 7;
while (1) {
switch (MOPF) {
case 0:
return 0;
case 1:
return 0;
case 2:
return 1;
case 3:
return 2;
case 4:
return 3;
case 5:
if (n % 2 == 0) {
MOPF = 3;
} else {
MOPF = 4;
}
break;
/* … dispatcher continues … */

Objective-C ships NO rename pass at all, by design — fully dynamic runtime method dispatch means there's no static boundary to prove a method name is safe to rename. Flatten and opaque predicates still work on real @implementation method bodies (confirmed here), verified only by reparsing the output with the plugin's own parser — no compiler or execution engine for Objective-C exists on this Windows machine to go further than that.

Why this actually raises the bar for reverse engineers

We're not going to invent a resistance percentage against a specific decompiler we haven't tested — here's plainly what each technique breaks and why.

Identifier renaming

Every function/class/variable name a decompiler would otherwise show you — validateLicense, calculateDiscount — becomes QRPB, L2RI. No semantic hints left for someone skimming a decompiled listing.

Control-flow flattening

Decompilers reconstruct if/while structure from a function's control-flow graph. Flattening collapses everything into one dispatcher loop switching on a state variable — the CFG a decompiler recovers is a flat star shape, not your original logic.

Opaque predicates

Branches guarded by algebraic identities that are always true (or always false for dead-code injection) look like real conditional logic to static analysis, but are provably constant — verified in our own test suite by actually compiling and running thousands of generated identities, not just eyeballing the algebra.

String encryption

No plaintext strings for strings/grep to find — error messages, URLs, license logic, all XOR-encoded behind a generated decoder.

Dead code injection

Unreachable filler statements guarded by an always-false predicate inflate the function for a human or a decompiler to wade through, without touching real behavior.

Bytecode virtualization

Our deepest technique (not used in the demos above, since it's narrowly scoped by design — see below): eligible functions get compiled to a custom instruction set and replaced with a small interpreter loop. Reversing the function now means reversing an unfamiliar VM before you even get to the logic itself.

Methodology & honesty notes

Every number on this page came from actually running shield obfuscate and then actually compiling/executing both versions on the same Windows machine — nothing here is estimated or simulated. Your numbers will vary by hardware, compiler version, and which transforms you enable.
The demos above intentionally used every implemented transform at once (PolyShield's "hardened" preset) — the maximum-protection, maximum-overhead end of the range. Most projects get strong protection from a lighter mix (e.g. renaming + string encryption only) with near-zero measured overhead in most of the languages above.
We don't publish a "resistance score" against named decompilers or deobfuscation tools — we haven't run that comparison, and a made-up number would be worse than no number. The technique breakdown above describes concretely what each pass changes and why that's harder to reverse, so you can judge it against your own threat model.
Build-time impact is reported only where a language has a real, separate compile step (Rust, C++, C, C#, Java, Swift, TypeScript, and assembly) — interpreted or JIT-run languages (JavaScript, Python, Dart, PHP, Go's own go run) have none to measure separately from execution.
Not every language above has full build/runtime numbers, and that's deliberate: Kotlin, Lua, and Objective-C are shown with real transformed code and real obfuscation-time/size numbers, but no fabricated performance numbers, because no working kotlinc, standalone Lua interpreter, or Objective-C compiler exists in the environment these demos were generated in. We'd rather show you "not measured" than make a number up.
Building this expanded page surfaced two real bugs in PolyShield itself, both found only by actually running generated output (not just reparsing it) — and both are now fixed and reflected in the demos above. First: the JavaScript/TypeScript bytecode_vm compiler was rebuilding its entire bytecode array and interpreter on every single call instead of once, which is brutal on a hot loop — fixed by hoisting both out to a one-time sibling declaration. Second: assembly's opaque_predicates/dead_code_injection decoys used non-local NASM labels, which silently reset which function a real .label reference resolves against, corrupting output whenever a decoy landed near a function's own local labels — fixed by making decoy labels dot-local too. Both fixes shipped with new regression tests and were re-verified end-to-end (real node/tsc execution, real nasm+link assemble/link/run) before this page was updated to show the complete, unrestricted transform pipeline for all three languages.
PolyShield supports 18 languages total; this page shows 16 of them. HTML is excluded for a permanent, architectural reason — it's a declarative markup language, not executable code, so rename/flatten/opaque-predicate/dead-code/ string-encryption obfuscation simply doesn't apply to it the way it does everywhere else (PolyShield still processes HTML files for comment stripping, just not as a "before/after obfuscation" demo). Luau — Roblox's own Lua dialect — is excluded for a different reason: it's the newest plugin, currently at bootstrap scope only (renames `local function` declarations; the 4-tier flatten/opaque-predicate/dead-code/bytecode-VM work every other language here has isn't built yet), so a demo of it today would show far less than what's coming, not a representative sample.

What actually happens when you look something up

No single black-box prompt doing all the work — here's the real pipeline behind it.

Crawl

We're constantly pulling in articles from a wide range of outlets, not just one feed.

Process

Before anything else happens, each document gets cleaned up, its language identified, and duplicates filtered out.

Extract claims

An AI pass reads the text and pulls out individual claims, then checks each one against the original wording so nothing gets misquoted.

Score sources

Every outlet's track record is scored on its own using metrics you can actually see — never just a fixed reputation label.

Rank evidence

If five sites are just repeating one wire story, that counts as one piece of evidence, not five separate confirmations.

Build confidence

Each claim gets a confidence score built from its actual evidence, and it says so plainly when that evidence just isn't there yet.

Ask questions

Ask a direct question in plain language and get an answer back with citations to the real evidence behind it.

Track & share

Save what you're following, watch entities and timelines over time, export your findings, and get alerted when something changes — solo or with a team.

One more thing: full-text search, CSV export, saved investigations, and in-app alerts are live right now. PDF export and semantic search aren't built yet — we'd rather tell you that up front than have you find out after you've paid.

Pricing

See it in action

One obfuscator for 18 languages

Doesn't break your build

Goes past source-level obfuscation

Every build traces back to the license that made it

Measured performance impact

Real before/after examples

Four protection tiers, not one setting

Rename & cleanup

String encryption

Control-flow obfuscation

Bytecode VM

Compiled bytecode + encrypted loader

Anti-debug & integrity checks

See the evidence before you buy

PolyShield benchmarks — all 16 obfuscatable languages

Rust

C++

JavaScript

Python

C

C#

Java

Go

Swift

TypeScript

Dart

PHP

x86-64 Assembly

Kotlin

Lua

Objective-C

Why this actually raises the bar for reverse engineers

Identifier renaming

Control-flow flattening

Opaque predicates

String encryption

Dead code injection

Bytecode virtualization

Methodology & honesty notes

We don't hand you a verdict

See why a source is trusted

Every claim links back to a real quote

Stories change, so we keep tracking them

What actually happens when you look something up

Crawl

Process

Extract claims

Score sources

Rank evidence

Build confidence

Ask questions

Track & share

Pick your languages & features

Complete your subscription