DEV Community: VEILVM

How to stop people from stealing your HTML5 game's JavaScript (without tanking FPS)

VEILVM — Tue, 03 Nov 2026 12:50:01 +0000

If you ship a Phaser, PixiJS, Cocos Creator (web), or Construct game, players already have your scripts. Opening DevTools → Sources is enough to read economy formulas, unlock flags, and anti-cheat stubs. Reskins on portals are not theoretical — they happen.

This post is a practical playbook: what to protect, what to leave alone, why VM-based protection has a real performance cost, and how to wire a selective pipeline. I'll use VEILVM (a browser JSVMP workspace I built) as the example tool, but the selective-protection idea applies even if you use something else.

The threat model (be honest)

Anything that runs on the player's device can eventually be reversed. Obfuscation and VM protection raise time and cost; they do not make code unbreakable. For competitive integrity you still want:

Server-authoritative scores / inventory when cheating matters
Purchase validation on your backend
Not shipping secrets (API keys, private matchmaking tokens) in the client at all

Client-side protection is for the other problem: clone and reskin. Someone who wants your drop tables, soft-currency curve, or paid unlock logic should have to work for it.

Why "just minify" and classic obfuscators fall short

Minification shrinks identifiers. Classic obfuscators (javascript-obfuscator and friends) add string encoding, control-flow flattening, dead code. The output is still ordinary JavaScript. Beautifiers and public undo scripts exist for many of those patterns.

JSVMP (JavaScript Virtual Machine Protection) takes a different route:

Parse selected source into an AST
Compile it to a custom bytecode
Ship a small interpreter that runs that bytecode

Attackers usually have to reverse or instrument the VM before they recover the original logic. Higher reverse-engineering cost — and higher size/CPU cost for you.

The rule that saves your frame budget

Do not put the whole game into the VM.

VM-protected code runs noticeably slower than native JS. If you wrap your render loop, physics step, or per-frame update, you will drop frames and players will blame "the game," not "the obfuscator."

Protect (small, high-value modules):

Purchase / entitlement checks
Save-game integrity / anti-tamper stubs
Level unlock gates
Economy, drop tables, damage formulas you don't want mirrored

Leave alone:

Phaser / Pixi / Cocos / engine runtime
Scene wiring and UI glue
Anything that runs every frame

Treat JSVMP like a scalpel, not a spray can.

A selective workflow that fits a bundler

src/
  economy/
    dropTable.js      ← protect this
    entitlement.js    ← protect this
  game/
    mainLoop.js       ← never protect
    render.js         ← never protect
dist/
  economy.protected.js

Build sketch:

Develop and playtest with plain modules.
Before production bundle, run only the critical files through a JSVMP step.
Import the protected outputs from the rest of the game as usual.
Measure FPS and load time on a mid-tier laptop and a phone — not only on your gaming PC.

Example: protect one helper, not the scene

// src/economy/dropTable.js  (protect this file only)
export function calcDropRate(enemyLevel, luck) {
  return Math.min(0.85, 0.05 + enemyLevel * 0.01 + luck * 0.002);
}

// src/game/battleScene.js  (leave readable / lightly minified)
import { calcDropRate } from "../economy/dropTable.js"; // or the protected build path

export function onEnemyDefeated(enemy, player) {
  if (Math.random() < calcDropRate(enemy.level, player.luck)) {
    grantLoot(enemy.lootTable);
  }
}

In CI you can call a hosted API instead of clicking the browser UI. VEILVM Pro exposes:

curl -X POST https://vm.ldvmp.com/api/v1/obfuscate \
  -H "Authorization: Bearer $VEILVM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code":"<contents of dropTable.js>","mode":"performance"}'

Max 2 MB source per API request
Modes: performance | dynamic
Docs: https://vm.ldvmp.com/docs/api

Keep the API key in CI secrets. Never commit it.

What "good" looks like after protection

Check	Pass criteria
Game still boots	No missing exports from protected modules
FPS on target device	Within ~your usual budget on hot paths (those paths should not be VM'd)
Bundle size	Only the protected files grew a lot; engine untouched
DevTools glance	Economy / entitlement no longer readable as normal JS

If FPS tanks, you protected too much — peel the VM off the frame loop first.

Engine notes (JavaScript only)

Stack	Fit	Note
Phaser / PixiJS / Babylon.js (web)	Strong	Protect logic modules before Vite/webpack pack
Cocos Creator (web / JS build)	Strong	Same idea on exported JS
Construct HTML5	Good	Focus on custom JS you care about
RPG Maker MV / MZ plugins	Strong	Plugins are JS; protect core logic, keep `@param` usable
Unity / Roblox / Lua FiveM scripts	None	Not JavaScript — wrong tool

Also skip channels that ban obfuscated submissions (browser extension stores, Greasy Fork). Shipping your own game build is a different story from uploading an obfuscated userscript.

Try before you rebuild the pipeline

VEILVM runs in the browser:

3 free runs a day, no sign-up, up to 5 KB per file (resets 00:00 UTC)
Free account: 20 runs/month, 30 KB/file
Pro: $9/mo or $79/year — 1,000 runs/month, no plan-level file-size cap, 2 concurrent jobs, HTTP API

Paste one entitlement or drop-table module first. If size and behavior look fine in your target browser, wire the same step into CI.

Takeaways

Client protection raises clone cost; it does not replace server checks.
Selective protection — billing, saves, levels, numeric cores — not the render/physics loop.
Expect size and CPU cost on whatever you put in the VM; measure on real devices.
Automate only the critical files in CI so every release stays consistent.

If you try this on a Phaser or Cocos web build, I'd love to hear what you protected and what you deliberately left alone — that trade-off is the whole game.

Pro API for JSVMP: call VEILVM's JS VM obfuscator from CI

VEILVM — Tue, 03 Nov 2026 11:59:13 +0000

I built VEILVM as a browser workspace that compiles JavaScript into a custom VM (JSVMP) — high-performance or dynamic mode — so small critical fragments are harder to reverse than with classic string/control-flow obfuscators.

Pro plans can now hit the same engines over HTTP, which is what you want for CI, batch jobs, or a private build step. API runs share the monthly quota with the web UI.

Quick facts (from the live docs)

POST https://vm.ldvmp.com/api/v1/obfuscate
Header: Authorization: Bearer veil_live_… (key shown once; up to 3 active keys per account)
Body: { "code": "<js>", "mode": "performance" | "dynamic" }
Max 2 MB source per request (UTF-8)
Success 200: { ok, output, inputBytes, outputBytes, ms, engine, engineVersion } plus X-Quota-Limit / X-Quota-Remaining
Plans: Try free 3 times a day, no sign-up; 20 runs a month after free signup; Pro $9/month or $79/year → 1,000 runs/month + API

Full reference: API documentation.

curl

curl -X POST https://vm.ldvmp.com/api/v1/obfuscate \
  -H "Authorization: Bearer $VEILVM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code":"console.log(\"hello\")","mode":"performance"}'

Node.js 18+ with Retry-After on 503

Cold starts or engine timeouts return 503 with ENGINE_UNAVAILABLE or TIMEOUT. Those runs are not charged. Wait for the Retry-After header (seconds), then retry. 500 INTERNAL_ERROR is also refunded — retry later. 422 COMPILE_FAILED is refunded (bad source, not a transient fault).

// Node.js 18+ — keep the key in an env var, never in the repo
import { readFile, writeFile } from "node:fs/promises";

async function obfuscate(code, mode = "performance", { maxAttempts = 4 } = {}) {
  let attempt = 0;
  while (true) {
    attempt += 1;
    const response = await fetch("https://vm.ldvmp.com/api/v1/obfuscate", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.VEILVM_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ code, mode }),
    });
    const data = await response.json();

    if (response.ok && data.ok) return data;

    const retriable =
      response.status === 503 ||
      response.status === 500 ||
      data.error === "ENGINE_UNAVAILABLE" ||
      data.error === "TIMEOUT" ||
      data.error === "INTERNAL_ERROR" ||
      data.error === "UNAVAILABLE" ||
      data.error === "QUOTA_UNAVAILABLE";

    if (!retriable || attempt >= maxAttempts) {
      throw new Error(`${response.status} ${data.error}: ${data.message}`);
    }

    const retryAfterHeader = response.headers.get("Retry-After");
    const waitSec = Number(retryAfterHeader);
    const delayMs =
      Number.isFinite(waitSec) && waitSec > 0
        ? waitSec * 1000
        : Math.min(8000, 1000 * 2 ** (attempt - 1));

    await new Promise((r) => setTimeout(r, delayMs));
  }
}

const code = await readFile("input.js", "utf8");
const data = await obfuscate(code, "dynamic");
await writeFile("output.js", data.output);
console.log(
  `${data.engine}: ${data.inputBytes} → ${data.outputBytes} bytes in ${data.ms} ms`
);

Error cheat sheet

HTTP	`error`	Notes
401	`INVALID_KEY`	Missing, malformed, revoked, or unknown
403	`PLAN_REQUIRED`	Account is no longer Pro — keys die immediately on downgrade
422	`COMPILE_FAILED`	Source would not compile — run refunded
429	`QUOTA_EXCEEDED`	Body includes `limit` / `used` / `remaining` / `resetAt`
503	`ENGINE_UNAVAILABLE` / `TIMEOUT`	Wait `Retry-After` seconds — run refunded
500	`INTERNAL_ERROR`	Retry later — run refunded

Honest caveats

VM output is larger and slower; protect small high-value functions, not your whole bundle.
No client-side obfuscation is unbreakable.
Keep keys server-side; revoke from the Account page if one leaks.

If you try it, I’d love feedback on CI integration vs a future CLI. Links: workspace · pricing · docs.

VEILVM: Browser-based JSVMP — compile JS into a custom VM, now with a Pro API

VEILVM — Tue, 03 Nov 2026 11:08:25 +0000

I built VEILVM, an online JSVMP (JavaScript Virtual Machine Protection) workbench. You paste JavaScript (or drop a .js / .mjs / .cjs file), pick an engine, and get an interpreter-plus-bytecode output you can copy or download.

Why a VM?

Minifiers and renamers leave your control flow as plain JavaScript. A beautifier plus a debugger often gets most of it back. VM-based protection maps the logic to custom instructions run by an embedded interpreter, which raises the cost of reverse engineering. The trade-off is size and speed, so it's best for small critical snippets, not your whole bundle.

Try it

Site: https://vm.ldvmp.com/en/?utm_source=devto&utm_medium=social&utm_campaign=launch
Try free 3 times a day with no sign-up (5 KB per file). Click "Load example" and run it; desktop shows source and output side by side.
Two engines: High-performance VM and Dynamic VM.
After free email signup: 20 runs a month, 30 KB per file.
Pro: $9/month (or $79/year) for 1,000 runs, billed via Paddle, 14-day refund on a first purchase.

Example from my own run: a 219-byte license check → about 10 KB in 228 ms on the High-performance VM.

Pro HTTP API

Pro (and above) can call obfuscation over HTTP for CI:

POST https://vm.ldvmp.com/api/v1/obfuscate
Authorization: Bearer veil_live_…

Docs: https://vm.ldvmp.com/docs/api

Keys are hashed at rest, capped at 3 per account, and stop working if the plan drops to free. Quota is shared with the web UI.

Caveats

No obfuscation is unbreakable. Uploaded files are deleted after 24 hours. Don't use it to obfuscate malware.

I'd love feedback on output size/speed, and on what you'd want next (CLI, Vite/Webpack plugin, or GitHub Action).