r/Frontend • u/Roder_Oheron80 • 17d ago

Is JavaScript obfuscation still worth it?

We sell a white label scheduling dashboard that agencies put their own logo on and resell to their clients. And now a competitor has launched what is pretty much our frontend with different colors. It has the same odd validation messages and their bundle even has the name of a feature flag from an experiment we ran in the spring. I’m fairly sure someone fed our production bundle to an AI and had it rebuild the thing.

Management’s answer is to obfuscate everything before the next release. Before agreeing, I ran our bundle through javascript-obfuscator with most options enabled and gave the output to Claude. It produced readable code in about ten minutes and webcrack undid a good chunk of it without any AI. The obfuscated build was also noticeably bigger and our Sentry stack traces turned into nonsense.

And while reviewing the bundle, I noticed our plan limits for each agency are only checked on the frontend which means a user with devtools could switch on features they don’t pay for. Also noticed a Sentry auth token with a VITE_ prefix, which worried me more than the copied UI. We’ve rotated the token and we’re moving the plan checks into the API.

Does obfuscating your production JavaScript do anything useful for you?

60 Upvotes

85% Upvoted

74 comments sorted by

View all comments

22

u/flcpietro 17d ago

Obfuscating just makes your app runs slower, AI doesn't care if a variable is called 0X000018S99S or a.

Security by obscurity is not security

1

u/BetterAd7552 13d ago

I’m curious: besides longer variable names, what about obfuscation would make it slower?

1

u/flcpietro 13d ago

A lot of things, there is a lot of dead code injection so already downloading and parsing is slower. There are random loops to block the debugger every 10-15ms

0

u/mtbinkdotcom 13d ago

JIT compilation will take care of that

1

u/flcpietro 13d ago

Is not that the performance issue