DKLib
Security

Markup Skill

Java Bytecode Obfuscator โ€” Spring Boot 100% Compatible

Protect your Java applications from reverse engineering. Method-level bytecode transformation with guaranteed Spring Boot, JPA, and MyBatis compatibility.

v1.0.0

Version

Java 17+

Platform

Apache 2.0

License

Your Java Code Is an Open Book

Anyone with a decompiler can read your business logic, API keys, and proprietary algorithms in minutes. Standard JAR files offer zero protection.

๐Ÿ‘๏ธ

Fully Readable

Java bytecode decompiles almost perfectly. Class names, method logic, string constants โ€” all exposed.

๐Ÿ’ธ

IP at Risk

Competitors can clone your algorithms. Attackers can find vulnerabilities and hardcoded secrets.

โฐ

Compliance Gaps

Shipping unprotected code fails security audits. Enterprise clients demand code protection.

Why Obfuze?

Built for real-world Spring Boot applications

๐Ÿ›ก๏ธ

Spring Boot 100% Compatible

Method-level transformation only. Never modifies signatures, annotations, or class names. Works perfectly with Spring DI, AOP, CGLIB proxies, and JPA.

โšก

7-Level Protection

String encryption, number obfuscation, flow obfuscation, control flow flattening, debug stripping, name obfuscation, and self-protecting decryptor โ€” all in one pass.

๐Ÿ”ง

Gradle & Maven & CLI

Free plugins for Gradle and Maven that integrate seamlessly into your build pipeline. Or use the CLI for standalone JAR/WAR processing.

๐Ÿข

Enterprise Ready

Tested with 100+ class Spring Boot projects including eGovFrame. Supports Fat JAR, WAR, CI/CD environments with offline grace period.

7-Level Protection

Each level adds another layer of defense

1

String Encryption

All string constants encrypted with XOR + runtime decryption. Per-string random key from full 32-bit key space. 3 encryption algorithm variants per build.

2

Number Obfuscation

Integer and long constants transformed into multi-stage XOR chains (2-5 stages randomly generated).

3

Flow Obfuscation

Opaque predicates (4 variants), dead code injection, and bogus branches inserted to confuse decompilers.

3.5

Control Flow Flattening

Transforms method bodies into XOR-keyed switch-based state machines with shuffled basic blocks. Enable with flatten=true.

4

Debug Stripping

Removes LineNumberTable, LocalVariableTable, and SourceFile attributes from all classes.

5

Name Obfuscation

Private classes, methods, and fields renamed with Spring-safe keep rules. Inheritance-aware renaming. Preserves Spring, JPA, Jackson, MyBatis annotations.

6

Self-Protection

Decryptor class generated with unique structure per build โ€” random field/method names, XOR masks, bogus branches, and encryption variants.

Before & After

See the transformation in action

Before
public class PaymentService {
  private final String API_KEY = "sk_live_abc123";
  private final String ENDPOINT = "/api/v2/charge";

  public Receipt charge(String cardToken, int amount) {
    log.info("Charging " + amount + " won");
    HttpResponse res = http.post(ENDPOINT,
      Map.of("token", cardToken, "amount", amount));
    if (res.statusCode() != 200) {
      throw new PaymentException("Payment failed");
    }
    return new Receipt(res.body(), amount);
  }
}
After
public class PaymentService {
  private final String ma = D.s("7f2a9b", 1839274);
  private final String mb = D.s("3c1e8d", 4729103);

  public Receipt charge(String O0OO, int lI1l) {
    if (System.nanoTime() * System.nanoTime() >= -1L) {
      log.info(new StringBuilder()
        .append(D.s("a3f1", 82741))
        .append(1928374 ^ 7261035 ^ 5332661)
        .append(D.s("f2c9", 39201)).toString());
      HttpResponse O00l = http.post(mb,
        Map.of(D.s("9e3a", 57281), O0OO,
          D.s("b1c4", 92837), lI1l));
      if (O00l.statusCode() != (3847 ^ 3647)) {
        throw new PaymentException(
          D.s("d4e2a1", 1029384));
      }
      return new Receipt(O00l.body(), lI1l);
    } else { int a = 9382 ^ 4721; }
    return null;
  }
}

Easy Integration

Choose your preferred workflow

Gradle Plugin
plugins {
    id 'io.obfuze' version '1.0.0'
}

obfuze {
    licenseKey = 'XXXX-XXXX-XXXX-XXXX'
    jpaSafe = true
    rename = false
    flatten = false
    flowSkip = ['/config/', '/filter/', '/interceptor/']
    skip = ['/generated/', '/proto/']
}

Compatibility

Tested and verified with major frameworks

โœ“Spring Boot / Spring MVC
โœ“Spring Security
โœ“MyBatis / JPA / Hibernate
โœ“AOP / CGLIB Proxies
โœ“Serializable Classes
โœ“Enums, Interfaces, Annotations
โœ“Java 17+
โœ“Gradle 8+ / Maven 3.9.6+
โœ“JAR / WAR / Fat JAR

Full Feature List

โ—†String encryption with per-string random keys (32-bit key space)
โ—†Number obfuscation via multi-stage XOR chains (2-5 stages)
โ—†Control flow obfuscation with 4 opaque predicate variants & dead code
โ—†Control flow flattening โ€” switch-based state machine transformation
โ—†Debug info stripping (line numbers, variable names, source files)
โ—†Name obfuscation for private classes, methods, and fields
โ—†Self-protecting decryptor class with per-build uniqueness
โ—†JPA entity auto-detection (@Entity, @Table, @MappedSuperclass, @Embeddable)
โ—†Spring-safe keep rules (Spring, JPA, Jackson, MyBatis annotations preserved)
โ—†invokedynamic desugaring for Java 9+ string concat
โ—†ConstantValue stripping (static final String to clinit initialization)
โ—†Configurable flow.skip and skip paths for fine-grained control
โ—†ProGuard-format mapping file (obfuze-mapping.txt) for stack trace decoding
โ—†JSON obfuscation report with per-class statistics
โ—†Fallback safety โ€” original bytecode preserved on transformation error

Simple, One-Time Pricing

Pay once, use forever. Free updates included.

Personal

For individual developers

$0

One-time payment ยท Lifetime license

Get Personal
  • โœ“All 7 obfuscation levels
  • โœ“CLI, Gradle & Maven support
  • โœ“JPA auto-detection
  • โœ“JSON obfuscation report
  • โœ“ProGuard-format mapping file
  • โœ“1 machine activation
  • โœ“Lifetime license + updates

1 machine

Professional

For teams & small companies

$

One-time payment ยท Lifetime license

Get Professional
  • โœ“Everything in Personal
  • โœ“3 machine activations
  • โœ“CI/CD offline grace period (7 days)
  • โœ“Priority support
  • โœ“Team license management

3 machines

Enterprise

For large enterprises & SI vendors

$

One-time payment ยท Lifetime license

Get Enterprise
  • โœ“Everything in Professional
  • โœ“Unlimited machine activations
  • โœ“Extended offline grace period
  • โœ“Dedicated support channel
  • โœ“Custom obfuscation profiles
  • โœ“Volume licensing available

Unlimited

All plans include Gradle & Maven plugin (free). Payments secured by Lemon Squeezy.

Frequently Asked Questions

Does Obfuze break Spring Boot applications?

No. Obfuze works at the method-level only โ€” it never modifies method signatures, annotations, class names, or constructors. Spring DI, AOP, CGLIB proxies, and JPA all continue to work exactly as before.

What Java versions are supported?

Obfuze requires Java 17 or higher. It supports JAR, WAR, and Spring Boot Fat JAR formats. Build system support includes Gradle 8+ and Maven 3.9.6+.

Is this a subscription?

No. All plans are one-time payments with lifetime licenses. You get free updates for as long as the product exists. No recurring charges, no hidden fees.

How does machine activation work?

When you first run Obfuze, it activates on that machine using your license key via Lemon Squeezy. Personal allows 1 machine, Professional allows 3, and Enterprise is unlimited.

Can I use it in CI/CD pipelines?

Yes. Professional and Enterprise plans include an offline grace period (7 days) specifically designed for CI/CD environments where network access may be limited.

What if obfuscation breaks something?

Obfuze has a built-in safety mechanism โ€” if any error occurs during a class transformation, it falls back to the original bytecode. You also get a detailed JSON report showing exactly what was obfuscated.

How do I read obfuscated stack traces?

When name obfuscation (rename=true) is enabled, Obfuze generates an obfuze-mapping.txt file in ProGuard format alongside the output JAR. Use this mapping file to decode obfuscated class, method, and field names in stack traces.

What happens if my license cache expires?

License is cached locally for 30 days at ~/.obfuze/license.json. When the cache expires, Obfuze re-validates with Lemon Squeezy. If the network is unavailable, a 7-day grace period allows continued usage (ideal for CI/CD).

What about refunds?

Refunds are handled by Lemon Squeezy. If a refund is issued, your license key is automatically deactivated. Contact support@dklib.dev for any licensing issues.

Protect Your Code Today

Stop worrying about reverse engineering. Get Obfuze and ship with confidence.

Get Obfuze Now