Security and code handling

You are being asked to upload compiled software to a server you do not control. That deserves a straight answer about what happens to it.

What happens to an uploaded file

An upload is read into memory, rewritten, and streamed straight back in the same HTTP response. It is never written to disk on our server and nothing is retained once the response completes. There is no upload archive, no processing queue holding your file, and no copy kept for debugging.

We also do not keep a name mapping. That is worth stating because it cuts both ways: there is nothing on our side that could reverse your obfuscation or leak your original symbol names — and equally, we cannot de-obfuscate a stack trace for you later. Keep your original build.

The honest caveat. Your assembly does leave your network to reach us. If you work under classification, a regulatory regime, or a contract that forbids sending build artifacts to third parties, use a tool that runs on your own machine instead — the comparisons cover local options including free ones. We would rather you pick the right tool than the convenient one.

What we record

Usage is counted as daily aggregates — how many obfuscations succeeded or failed on a given day, by plan and by entry point. Nothing about the file itself is recorded: not its name, not its contents, not its type names, not who uploaded it.

Application logs record errors so faults can be diagnosed. When obfuscation fails, the underlying exception is logged server-side and you receive a generic message — deliberately, so internal detail is not echoed back over the wire.

Accounts and payment

  • No account is needed to use the free tier. You can obfuscate a file without telling us anything about yourself.
  • For paid accounts we store an email address, a password hash and subscription status. Nothing else.
  • Card details never reach our servers. Payment runs entirely through Stripe; we receive only a customer and subscription identifier.
  • API keys are shown only to the account that owns them, are masked by default in the interface, and can be rotated at any time from your account page. Rotation invalidates the previous key immediately.

Transport and application security

  • All traffic is served over HTTPS, with HSTS enabled.
  • X-Content-Type-Options, X-Frame-Options and a Referrer-Policy are set on every response.
  • Diagnostic pages that expose infrastructure detail require authentication; they are not publicly reachable.
  • Oversized uploads are rejected on the request headers, before any file data is buffered.
  • Concurrent obfuscation is bounded, so a burst of traffic degrades into a queue rather than exhausting the server.

What this tool does not do

Being clear about the limits matters more on a security page than anywhere else:

  • Renaming plus optional string encryption. There is no control-flow obfuscation, anti-debugging or anti-tamper.
  • String encryption is opt-in. With it on, string literals are encrypted and no longer readable in a decompiler. It removes the plaintext, but a determined reader can still run the decryptor — so it is not a substitute for keeping real secrets out of a client binary and on the server.
  • It is not a licensing system. A check running on a machine the user controls can ultimately be defeated; obfuscation raises the cost, and server-side validation is what changes the outcome.

What obfuscation actually protects against goes through the threat model properly.

Who operates this

FreeObfuscator is built and run by Richscripts Inc., which has been shipping developer tools since 2003 — editors, upload components, live chat and obfuscation products used by development teams worldwide. This is not an anonymous utility that appeared last month.

More on that in about us, and the privacy page covers data handling in policy terms.

Reporting a security issue

If you believe you have found a vulnerability, email [email protected] with enough detail to reproduce it. We will confirm receipt and keep you informed. Please give us a reasonable window to fix an issue before disclosing it publicly.