CUSTOM BYTECODE VM · LUAU / ROBLOX LUAU

Build-specific Luau protection, backed by a real pipeline.

Darkfuscator parses source, applies a configurable semantics-preserving IR and conservative optimization, compiles custom bytecode, serializes a randomized protected payload, and emits a custom VM loader. Manage actual builds, projects, API keys, and account security in one authenticated platform.

Start a protected build Enter your key Read the docs

Obfuscation raises the cost of reverse engineering. It is not a security boundary and cannot make client-side code impossible to analyze.

ASTparsed input

VMcustom bytecode runtime

3protection presets

2implemented targets

APIkey-authenticated builds

What the engine actually does

Parse and analyze

A Luau lexer and parser build an AST and scope information before source reaches the compiler. Invalid input receives a real parse error instead of a fabricated result.

Compile custom bytecode

The compiler lowers supported syntax into a purpose-built register bytecode format, then applies conservative optimization and constant-pool handling.

Randomize each build

Build seeds drive opcode layout, payload alphabet, register layout, dispatch order, names, and encoded constants. Supply a seed when reproducible structure matters.

Protect and verify payloads

The emitted loader includes encoded payload data, optional RLE compression when it reduces size, and selectable integrity verification that safely stops on a failed check.

Run through a custom VM

Protected output executes through Darkfuscator’s generated Luau VM. FAST, BALANCED, and SECURE runtime layouts trade overhead for structural variation.

Store only what you choose

History records real backend builds. Source retention is opt-in per build so rebuild capability never has to mean retaining every input.

A practical platform workflow

01 / Create a project

Keep target and protection defaults with the project that owns the script. Your source is not automatically saved merely because a project exists.

02 / Build in the workspace

Validate source locally, then submit to the authenticated backend. The output, statistics, warnings, and history entry come from the real engine.

03 / Automate when ready

Create an API key in your account and call the documented protected-build endpoint from your own tooling. Full key secrets are shown only once.

Use the platform from your build tooling

API keys are created in an authenticated account and sent as Bearer credentials. Only the documented Luau and Roblox Luau targets are accepted.

curl -X POST https://YOUR-DOMAIN.example/api/v1/obfuscate \
  -H "Authorization: Bearer dk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"source":"print(1)","preset":"maximum","target":"luau"}'

Read the API reference

Important limitations

Can Darkfuscator make client-side code impossible to reverse?

No. A determined attacker can inspect or modify code that executes in a client-controlled environment. Use server-side authority for secrets, trust decisions, and irreversible actions.

Which targets are supported?

The platform accepts Luau and Roblox Luau. It does not advertise generic Lua, executors, or unsupported runtimes as compatible targets.

What happens when integrity verification fails?

The generated decoder returns before reconstructing or executing the protected program. It does not intentionally hang or damage the runtime.