Protect Your HTML5 Game's JavaScript from Copycats
If your game runs in the browser, players already have your assets and your scripts. Phaser, PixiJS, Cocos Creator (web), Construct, and many itch.io HTML5 builds ship core logic as readable JavaScript. Casual minification stops almost nobody who wants to clone economy numbers, anti-cheat checks, or paid unlocks.
This page is a practical playbook: what is worth protecting with JSVMP (JavaScript Virtual Machine Protection), what to leave alone, and how to try it in the browser with VEILVM.
The real threat for web games
Typical copycat flow:
- Open DevTools → Sources
- Beautify or search for score formulas, IAP flags, RNG seeds
- Patch values or republish a reskin on another portal
Classic obfuscators (rename + string encode + control-flow flatten) still emit JavaScript. Dedicated undo scripts exist for many of those transforms. JSVMP compiles selected functions into custom bytecode plus a small interpreter, so an attacker usually has to reverse the VM before recovering the original logic. That raises time and cost — it is not unbreakable.
What to protect (and what not to)
Protect (small, high-value fragments):
- Purchase / entitlement checks
- Anti-cheat or integrity kernels
- Economy formulas and drop tables you do not want mirrored
- Watermark or ownership strings
Do not VM-protect the whole bundle:
- Engine runtime (Phaser, Pixi, Cocos)
- UI glue and scene wiring
- Large third-party libraries
VM output is larger and slower. Use it like a scalpel on the few functions that hurt if leaked.
Engine notes (JavaScript only)
| Stack | Fit for VEILVM | Note |
|---|---|---|
| Phaser / PixiJS / Babylon.js (web) | Strong | Pure JS; protect game logic modules before bundling |
| Cocos Creator (web / JS build) | Strong | Export JS build, protect critical scripts, keep config readable if needed |
| Construct (HTML5 export) | Good | Protect custom JS plugins / event scripts you care about |
| RPG Maker MV / MZ plugins | Strong | Plugins are JS; many paid authors already obfuscate (see separate guide) |
| Unity / Unreal / Roblox / Lua scripts | None | Not JavaScript — out of scope for VEILVM |
Workflow that fits CI
- Keep source in a private repo.
- Isolate critical functions into small modules.
- Run those modules through VEILVM (browser or Pro API).
- Bundle the protected output with the rest of the game as usual.
- Ship to itch.io, CrazyGames, Poki, or your own host.
Pro API accepts up to 2 MB of source per request — useful for larger logic modules in a build pipeline.
Try it without signing up
- 3 free runs a day, no sign-up, up to 5 KB per file (resets 00:00 UTC)
- Free account: 20 runs/month, 30 KB/file
- Pro: $9/mo or $79/year — 1,000 runs/month, no plan-level file-size cap, 2 concurrent jobs, HTTP API
Paste a license check or economy helper first. If size/speed looks fine in your target browser, wire the same step into CI with Pro.
FAQ
Will this stop every cheater?
No. Anything that runs on the player's device can eventually be analyzed. JSVMP raises reverse-engineering cost; combine it with server-authoritative score and purchase validation when cheating matters.
Can I protect a whole Phaser project?
You can try, but you usually should not. Protect the critical modules only so load time and FPS stay acceptable.
Is this allowed on itch.io / HTML5 portals?
Yes for your shipped game code. Store policies that ban obfuscated extensions (Chrome Web Store, Greasy Fork) do not apply to shipping your own game build.