Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to obfuscate all the webpages of my website. I Googled through some free tools like HTML and Javascript obfuscation but don't know how effective they are.

First of all, does it makes sense to obfuscate a webpage that could comprise of variety of codes like Javascript, PHP etc.

Secondly, how effective is this method?

share|improve this question
Could you clarify and describe why you need such protection? – user2567 Dec 26 '10 at 19:30
The best javascript obfuscator I know is Stunnix: – user2567 Dec 26 '10 at 19:59
RPK: the technique is obfuscating a javascript file that contains the function that will generate the HTML for the paypal buttons. You call that function in your clear HTML. – user2567 Dec 26 '10 at 20:13
At some point, real HTML needs to be sent to the browser, and the user will be able to inspect it dynamically using a tool such as Firebug. – realworldcoder Dec 26 '10 at 20:26
Even if you obfuscate the Javascript, you can just use Firebug which will pretty-print the generated HTML. Even if you obfuscate the HTML, Firebug will still do a pretty good job of pretty-printing it, making the whole thing largely useless. PayPal understand this, and the code they give you is given with the understanding that it'll be in plain text on your site. In short: don't worry. – Dean Harding Dec 27 '10 at 0:03
up vote 4 down vote accepted

The best security against information being wrongfully used is to avoid sending the information over a public communications network.
If that is not an option, you have to consider who and what you are trying to protect against.

If you want to be safe from third-parties snooping the traffic between your website and your customers, then don't bother with obfuscating the webpages, but use a secure connection instead.

If you don't want your users to access some information that is needed by the browser for displaying the page or generating the next request, then encryption won't help you (the browser needs to be able to decrypt the information anyway) and obfuscation might at best slow someone down but it won't stop them obtaining the information.

For really sensitive information, you could store it locally on the server and only give out a (one time) unique ID for accessing the information on the next request.

As a sidenote, using obfuscation might make people more interested in knowing what you are trying to hide.

share|improve this answer

Obfuscating to attempt to hide PayPal button codes is not time well spent. You will not get a return on the time you spend on this so it is not worth the effort. Like others point out it can all be reversed so you will not be limiting those interested in finding out what goes on in your pages.

share|improve this answer
Than how to encrypt the content. Any way out? – RPK Dec 27 '10 at 6:29
If you want to hide, don't use open standards. – dan_waterworth Dec 27 '10 at 8:32

There is a way to make a text illegible for search engines and web crawlers while maintaining it readable for humans:

  1. You encode your text using some simple substitution cipher, such as ROT13 or Atbash.
  2. You apply to that text an special font (whose symbols have been unordered) that makes readable the encoded text, by reversing the substitution previously made.

I created an project at Github, called TuringFonts, that provides some resources and examples for implement this hack.

share|improve this answer
But that probably won't work for blind people, who are using some speaking software to browse the web. – Basile Starynkevitch Apr 16 '15 at 11:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.