Portable Lua subset
Authored examples and 10 mocked GUI scenarios compare return values in Fengari Lua 5.3. Mocks do not validate Roblox rendering, scheduling or engine behavior.
LUA / LUAU · PROTOTYPE 0.2
Less exposed.
Still inspectable.
Rename locals in a parsed Lua subset. Mask literal bytes. Keep control over what changes.
02 / TRANSFORM
Your code, transformed server-side.
Public service, no sign-in. Pressing Obfuscate uploads source to Cloudflare over HTTPS. This app does not save or log source, and never runs it. Do not submit credentials. Network/account metadata and rate-limit counters are still processed.
TRY A SAMPLE
Single-line rejects
--! directives; it never drops them.Single-line strings become reversible byte escapes. No grammar/type validation.
Drop a .lua / .luau / .txt file · uploaded only on Obfuscate
Ready. Source is sent only when you press Obfuscate.
Run notes
A successful lexical pass is not proof your script works in Roblox. Always test the result in Studio.
Lexical checks only
Types and token boundaries are retained. There is no Luau grammar or type checker, and no Roblox API execution.
Byte recovery succeeds
Direct tests recover escaped bytes, GUI labels and API names from one-line output. No guarded API refusal or ownership marker is counted as resistance.
03 / KEEP IT SERVER-SIDEProtect the part that matters
Put private Roblox logic in ServerScriptService and ModuleScripts inside server-only containers—not ReplicatedStorage or a LocalScript.
Treat every client request as untrusted. Validate RemoteEvent / RemoteFunction arguments, ownership, permissions, state transitions and rate limits on the server.
External APIs need server-held credentials, per-operation authentication and authorization, scoped tokens, replay protection and quotas. Never accept arbitrary code or expose a generic execution endpoint.
Cloudflare cannot run Roblox APIs. It can host this transformation service—not replace the Roblox server runtime.
What this build does not do
- No VM virtualization, encryption, anti-analysis or “AI-proof” claims.
- No Luau name renaming. Types remain only in lexical modes; backticks and attributes are rejected.
- Source is uploaded on request. No application source storage, analytics, API keys in the browser, or code execution.
- 32 KiB input, 128 KiB output, 50 ms cooperative engine budget, and native request limits.
Lua 5.1 renaming uses a real parser and explicit scopes. Reflection/loader names are rejected in that mode. Error text, debug names, timing and memory use are not preserved.