> For the complete documentation index, see [llms.txt](https://infinitode-docs.gitbook.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infinitode-docs.gitbook.io/documentation/package-documentation/cloakjs-package-documentation/cloakjs-reference/cloakjs-options.md).

# Options & Presets

Reference for every CloakJS 1.3.0 option — identifier mangling and escaping, string encryption, splitting, alphabet and decoys, number encoding, control flow flattening, dead code, opaque predicates,

CloakJS 1.3.0 has 24 settings. A preset is a fixed combination of them; an options object overrides the keys you supply and leaves the rest at their defaults.

## Preset matrix

| Option                    |   `off`  |   `low`  | `medium` |  `high`  | `extreme` |
| ------------------------- | :------: | :------: | :------: | :------: | :-------: |
| `identifierMangling`      |     –    |     ✓    |     ✓    |     ✓    |     ✓     |
| `identifierEscaping`      |     –    |     –    |     –    |     –    |     ✓     |
| `preserveFunctionNames`   |     –    |     –    |     –    |     –    |     –     |
| `stringEncryption`        |     –    |     –    |     ✓    |     ✓    |     ✓     |
| `stringEncoding`          |    rc4   |    rc4   |  base64  |    rc4   |    rc4    |
| `stringAlphabet`          | shuffled | shuffled | standard | shuffled |  shuffled |
| `stringArrayShuffle`      |     ✓    |     ✓    |     –    |     ✓    |     ✓     |
| `stringArrayDecoys`       |     0    |     0    |     0    |     0    |     6     |
| `stringSplitting`         |     –    |     –    |     –    |     –    |     ✓     |
| `stringSplitMinLength`    |     8    |     8    |     8    |     8    |     6     |
| `stringSplitMaxParts`     |     4    |     4    |     4    |     4    |     5     |
| `numberEncoding`          |     –    |     –    |     ✓    |     ✓    |     ✓     |
| `controlFlowFlattening`   |     –    |     –    |     –    |     ✓    |     ✓     |
| `controlFlowThreshold`    |     1    |     1    |     1    |     1    |     1     |
| `deadCodeInjection`       |     –    |     –    |     –    |     ✓    |     ✓     |
| `deadCodeAmount`          |     3    |     3    |     3    |     3    |     6     |
| `opaquePredicates`        |     –    |     –    |     –    |     ✓    |     ✓     |
| `selfDefending`           |     –    |     –    |     –    |     ✓    |     ✓     |
| `debugProtection`         |     –    |     –    |     –    |     –    |     ✓     |
| `debugProtectionInterval` |   4000   |   4000   |   4000   |   4000   |    2500   |
| `disableConsoleOutput`    |     –    |     –    |     –    |     –    |     –     |
| `wrapInIife`              |     –    |     –    |     –    |     –    |     –     |
| `compactOutput`           |     ✓    |     ✓    |     ✓    |     ✓    |     ✓     |
| `seed`                    |   null   |   null   |   null   |   null   |    null   |

Reading the table:

* **`extreme` is a genuine mode, not a relabelled `high`.** It adds identifier escaping, string splitting, six decoy string-array entries, the maximum decoy amount and an anti-debugging timer.
* **`high` is the default.** Calling a method without `options` uses the default settings, which equal `high`.
* **No preset enables `disableConsoleOutput` or `wrapInIife`** — both change what your program does, so they stay opt-in.
* **`preserveFunctionNames` is off everywhere.** Turn it on yourself if you depend on `Function#name`.
* The presets are independent copies that each define **every** key, so you can compare or spread them safely.
* `off` still applies `compactOutput` and `stringArrayShuffle`, and `medium` deliberately uses the weaker `base64`/`standard`/no-shuffle combination — cheap, but a smaller step up from `low`.

```js
CloakJS.resolveOptions('low');                       // the low preset, validated, as a copy
CloakJS.resolveOptions({ stringEncryption: false }); // defaults + your override
CloakJS.defaultOptions;                              // the high settings
```

## Identifier options

### `identifierMangling` (boolean, default `true`)

Renames declared bindings — `var`/`let`/`const`, function declarations, named function expressions, parameter lists (including defaults and rest parameters), `catch (…)` clauses and class names — to generated spellings, replacing every occurrence.

* **Scope-aware.** A spelling is renamed only when **every** occurrence lies inside a scope that declares it, so globals owned by other scripts keep working.
* **Template substitutions are analysed**, so `` `${count}` `` is renamed along with the rest of the code.
* **Skipped entirely** when the source uses `eval()`, `with()`, `new Function("…")` built from a string, or module syntax — each is reported in `warnings`.
* **Never touched:** property names, object keys and shorthand properties, method and field names, labels, destructuring patterns, module bindings, and anything reachable through a string key such as `obj["name"]`.
* **Class and function names change**, which affects `Function#name` and `constructor.name` — see `preserveFunctionNames`.
* **Public APIs are at risk:** top-level declarations are renamed too. Disable mangling for files whose names other scripts look up.

### `identifierEscaping` (boolean, default `false`, `true` in `extreme`)

Rewrites identifiers with unicode escapes, so `_0x1a2b` becomes something like `_\u0030\u0078\u0031a2b`. The escapes normalise to the same name, so **behaviour is unchanged** — the source simply stops matching grep patterns and naive string searches.

### `preserveFunctionNames` (boolean, default `false`)

Keeps function and class names, so `Function#name` and `constructor.name` stay readable. Useful when your own code, a framework or a test suite reads those names.

## String options

### `stringEncryption` (boolean, default `true`)

Moves eligible string literals into an encoded array read through a generated decoder, with call sites like `_0x1f3(0x2,41)` — sometimes with decoy arguments.

* **Static template literals are treated like ordinary strings**; tagged templates are skipped.
* **Skipped:** directive prologues, object keys, `case` labels, method names, and `import`/`export` specifiers.
* **This is obfuscation, not cryptographic protection.** The key, alphabet and decoder all ship with the output. Never use it to protect a secret.
* **No runtime APIs are required** — the decoder is self-contained, using `TextDecoder`/`Uint8Array` only as a fast path when the host has them.

### `stringEncoding` (`"base64"` | `"rc4"`, default `"rc4"`)

The cipher applied to each payload. `rc4` uses a **random per-run key**, which is stronger; `base64` is merely an encoding, and is what `medium` uses.

### `stringAlphabet` (`"standard"` | `"shuffled"`, default `"shuffled"`)

Base64 alphabet substitution for the array, with optional reversal of each entry. `shuffled` means a dump of the array no longer decodes with a standard Base64 decoder.

### `stringArrayShuffle` (boolean, default `true`)

Shuffles array entries and adds an index map, so an entry's position leaks nothing about where it is used.

### `stringArrayDecoys` (count, default `0`, `6` in `extreme`)

Adds unused, well-formed entries to the string array, so the array can't be read as "one entry per literal in order".

### `stringSplitting` (boolean, default `false`, `true` in `extreme`)

Splits strings into **codepoint-safe** chunks — never inside an emoji or surrogate pair — that are decoded separately and concatenated. With encryption on, each chunk becomes its own array entry, so no single entry holds a complete string. Can be used with `stringEncryption: false`.

### `stringSplitMinLength` (count, default `8`, `6` in `extreme`)

The shortest string that may be split.

### `stringSplitMaxParts` (count, default `4`, `5` in `extreme`)

The upper bound on chunks per string.

## Number and control-flow options

### `numberEncoding` (boolean, default `true`)

Rewrites numeric literals as hex, binary, octal, XOR/OR masks, shifts, `~`, sums, products with remainder, or exact power-of-two scaling.

* **Single-digit literals are left alone** — rewriting `2` as something longer isn't worth it.
* **BigInts and `Infinity`/`NaN` are preserved**, as are numeric separators such as `10_000`.
* **Floats are only scaled by powers of two**, so their values stay bit-exact.

### `controlFlowFlattening` (boolean, default `true`)

Splits each region — a function body or the top level — into statements and moves runs that can't change hoisting, scoping or jump targets into `switch` clauses with random labels. Case clauses are emitted in a shuffled layout while a sequence array preserves execution order, and decoy cases are never selected. Nested function bodies are flattened **before** the bodies that contain them.

* **Statements that stay outside the dispatcher:** declarations (`var`/`let`/`const`/`function`/`class`), `do…while` bodies, `else`/`catch`/`finally` continuations, and the final top-level statement.
* **Statement order is preserved**, and observable behaviour is checked by the test suite.

### `controlFlowThreshold` (ratio, default `1`)

The probability of flattening each eligible statement run. `1` flattens all of them, `0` disables flattening entirely, and a value in between randomises how much of the file is dispatched — useful for making a build less uniform.

### `deadCodeInjection` (boolean, default `true`)

Inserts unreachable decoy blocks that reference real runtime pieces (loops, local helper functions, decoy decoder lookups, array operations) so they can't be dismissed by pattern alone, plus dispatcher cases that can never be selected.

* Injection points are only chosen after a `;` whose neighbours aren't `else`/`while`/`catch`/`finally`, and never in a position that would change the script's completion value.
* Decoys never execute, but they are the main reason output grows.

### `deadCodeAmount` (count, default `3`, `6` in `extreme`)

Roughly how many decoy statements go into each inserted block.

### `opaquePredicates` (boolean, default `true`)

Generates conditions whose value is computed at obfuscation time and verified with `Function`, so a guard that should be true always is. They wrap statements, dispatchers and dead branches.

## Runtime guards

### `selfDefending` (boolean, default `true`)

Adds a prelude that hashes the source text of generated functions through `Function.prototype.toString()` and throws `Error("Unexpected token")` when the text no longer matches — including when a patched `toString` returns `[native code]`.

* **Whitespace is ignored by the hash**, so re-indenting the output still runs. Renaming or patching a generated function does not.
* **It covers the generated decoder and its own probe function** — it does **not** detect an attacker who removes the check.
* **It conflicts with minification.** If the output goes through Terser, esbuild or webpack again, turn `selfDefending` off, or obfuscate after minifying.
* **It also prevents double obfuscation:** re-obfuscating `high`/`extreme` output rewrites the guarded functions and throws at runtime.

### `debugProtection` (boolean, default `false`, `true` in `extreme`)

Installs `setInterval(function () { … debugger … }, interval)`, guarded by `typeof setInterval`, and calls `.unref()` on the handle when it supports it so Node.js processes can still exit.

* **It changes behaviour**, which is why only `extreme` enables it.
* It's a debugging deterrent, not an anti-tamper mechanism: a determined analyst can neutralise a timer.

### `debugProtectionInterval` (count, ms, default `4000`, `2500` in `extreme`)

The timer period for the `debugger` trap. Values below 50 ms are raised to 50.

### `disableConsoleOutput` (boolean, default `false`)

Replaces common `console` methods — `log`, `info`, `warn`, `error`, `debug`, `trace`, `dir`, `table`, `group`, `groupEnd`, `time`, `timeEnd`, `assert`, `count` — with no-ops before the payload runs.

{% hint style="danger" %}
This silences the console for the **whole page or process**, not just for your code, and no preset enables it. Only use it when you deliberately want that.
{% endhint %}

### `wrapInIife` (boolean, default `false`)

Wraps the program in `(function(){ … })();` so top-level `var`/`function` declarations and top-level `this` stop leaking to the global object.

* **Two side effects:** the completion value of the script becomes `undefined`, and a leading `"use strict";` is moved inside the wrapper.
* No preset enables it, because it changes how your script interacts with the page.

## Output options

### `compactOutput` (boolean, default `true`)

Collapses blank lines and indentation. The pass is **token-aware**, so string and template bodies are never touched.

* **It is not a minifier.** It doesn't rename or shorten anything beyond what the other passes do; for real minification, run your own minifier (or use `cloakjs.min.js`) *before* obfuscating.
* Turn it off (`compactOutput: false`) to get line-based output that's easier to read while debugging a transform problem.

### `seed` (string | number | null, default `null`)

Seeds the generator for reproducible output: the same source, options and seed produce byte-identical code, and the seed is reported in `stats.seed`. `null` (the default) means fresh randomness on every run, which is what you want for a release build. See [Reproducible output with `seed`](/documentation/package-documentation/cloakjs-package-documentation/cloakjs-reference.md#reproducible-output-with-seed).

## Choosing settings

| Your goal                                             | Suggested settings                                                         |
| ----------------------------------------------------- | -------------------------------------------------------------------------- |
| See exactly what the tool does                        | `'off'`, then compare `stats` between runs                                 |
| Mildly discourage casual reading, keep files small    | `'low'`                                                                    |
| Encoded strings without dispatchers, decoys or guards | `'medium'`                                                                 |
| Strong, balanced obfuscation                          | `'high'`                                                                   |
| Maximum friction, size no object                      | `'extreme'`                                                                |
| Output will be minified afterwards                    | `{ selfDefending: false }` (plus `debugProtection: false`)                 |
| Reproducible CI build                                 | `{ seed: process.env.BUILD_ID }`                                           |
| Debugging a transform problem                         | `{ compactOutput: false, deadCodeInjection: false, selfDefending: false }` |
| Code reads `Function#name`                            | `{ preserveFunctionNames: true }`                                          |
| Tree-shaken / bundler-friendly output                 | `{ selfDefending: false, wrapInIife: false }`                              |

## Option validation

Every option key and value type is checked before anything runs, so mistakes surface immediately rather than producing silently under-obfuscated output:

```
TypeError: CloakJS: unknown option "stringEncrypton"
TypeError: CloakJS: option "stringEncryption" must be true or false
TypeError: CloakJS: option "stringEncoding" must be one of: base64, rc4
Error: CloakJS: unknown preset "strongest". Valid presets: off, low, medium, high, extreme
```

`CloakJS.resolveOptions(options)` returns the validated result, which makes it a handy way to see the effective settings — and, because it returns a fresh object, `CloakJS.presets` and `CloakJS.defaultOptions` are never mutated by your edits.

## Related pages

* [API reference](/documentation/package-documentation/cloakjs-package-documentation/cloakjs-reference.md) — methods, `stats`, `warnings`, errors and limits.
* [Usage examples](/documentation/package-documentation/cloakjs-package-documentation/cloakjs-usage-examples.md) — browser, Node and build-pipeline walkthroughs.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://infinitode-docs.gitbook.io/documentation/package-documentation/cloakjs-package-documentation/cloakjs-reference/cloakjs-options.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.