The situation
A desktop application is installed on machines you do not control. Every customer, competitor and curious tinkerer holds a complete copy of your compiled code, and .NET assemblies decompile back to near-original C#.
This is the most common reason people obfuscate. The realistic goal is not making your code unreadable forever — it is making a casual look unproductive.
What you are exposed to
- A competitor decompiling your build to study how a feature works.
- Someone lifting a specific algorithm or business rule wholesale.
- Internal class names leaking unreleased product names, customers or partners.
- Users locating and disabling licence or trial checks.
What obfuscation does here
- Method, field and property names become meaningless, so nobody can search your assembly for "License" or "Trial" and land on the right code.
- As an application rather than a library, the public surface can be renamed too — the strongest coverage this tool offers.
- The whole build takes about a minute, so it fits before code signing on every release.
What it does not do
Worth being clear about the limits before you rely on this.
- String literals are not encrypted. Your "Your trial has expired" message is still in the binary and is often the fastest route to the licence code.
- A licence check running on the user's machine can ultimately be defeated. Obfuscation raises the cost; server-side validation is what actually changes the outcome.
- XAML resolves bindings, commands and converters by name at runtime — test every window before shipping.
Suggested setup
| Plan | Free covers a single assembly under 1 MB. Pro if your app is larger or ships several assemblies you want done in one batch. |
| Public names | Enable it. An application is normally the end of the dependency chain, so renaming the public surface is safe and gives the best coverage. Leave it off if your app hosts plugins that bind to its types. |
| Workflow | Build in Release, run your tests, obfuscate, smoke-test the obfuscated build, then sign. Signing must come last — rewriting the assembly invalidates an existing signature. |
Test this before you ship
Obfuscation only breaks things that resolve a name at runtime, so a short checklist catches nearly everything:
- The app starts and reaches its main window.
- Every view renders with data (empty fields mean a broken XAML binding).
- Settings save and reload — that exercises serialization.
- Licence activation and the expiry path both still behave.
If something does break, obfuscation and reflection lists each cause with its fix.