How do I hide javascript code in a webpage? [duplicate]how to hide javascript codehide javascript/jquery scripts from html page?is it possible to hide the code written in javascript?How do you hide Javascript?How can I hide my javascript source in browser?Hiding javascript files from publicHow can I obfuscate (protect) JavaScript?How can I hide or encrypt JavaScript code?How can I block direct access to my JavaScript files?Any way to hide CSS and JavaScript file from the client-side user?How do JavaScript closures work?JavaScript post request like a form submitHow do I detect a click outside an element?How can I obfuscate (protect) JavaScript?How do I remove a property from a JavaScript object?How do I redirect to another webpage?How do I include a JavaScript file in another JavaScript file?What does “use strict” do in JavaScript, and what is the reasoning behind it?How to check whether a string contains a substring in JavaScript?How do I remove a particular element from an array in JavaScript?

Why did it become so much more expensive to start a university?

Curious question about cardinality of finite sets

What is this unknown executable on my boot volume? Is it Malicious?

Where to disclose a zero day vulnerability

What jurisdiction do Scottish courts have over the Westminster parliament?

Double it your way

A shy person in a queue

What is a realistic time needed to get a properly trained army?

Relocation error, error code (127) after last updates

Is there any way to land a rover on the Moon without using any thrusters?

Parallel resistance in electric circuits

Are scroll bars dead in 2019?

How do email clients "send later" without storing a password?

How to stabilise the bicycle seatpost and saddle when it is all the way up?

What officially disallows US presidents from driving?

Where can I get an anonymous Rav Kav card issued?

How do I determine what is "magic" and "bearing magic" for Detect Magic?

Will replacing a fake visa with a different fake visa cause me problems when applying for a legal study permit?

Job offer without any details but asking me to withdraw other applications - is it normal?

Why would "an mule" be used instead of "a mule"?

Glue or not to glue boots

Why did they ever make smaller than full-frame sensors?

Is it appropriate for a professor to require students to sign a non-disclosure agreement before being taught?

Why do sellers care about down payments?

How do I hide javascript code in a webpage? [duplicate]

how to hide javascript codehide javascript/jquery scripts from html page?is it possible to hide the code written in javascript?How do you hide Javascript?How can I hide my javascript source in browser?Hiding javascript files from publicHow can I obfuscate (protect) JavaScript?How can I hide or encrypt JavaScript code?How can I block direct access to my JavaScript files?Any way to hide CSS and JavaScript file from the client-side user?How do JavaScript closures work?JavaScript post request like a form submitHow do I detect a click outside an element?How can I obfuscate (protect) JavaScript?How do I remove a property from a JavaScript object?How do I redirect to another webpage?How do I include a JavaScript file in another JavaScript file?What does “use strict” do in JavaScript, and what is the reasoning behind it?How to check whether a string contains a substring in JavaScript?How do I remove a particular element from an array in JavaScript?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

This question already has an answer here:

how to hide javascript code [duplicate]

4 answers

Is it possible to hide the Javascript code from the html of a webpage, when the source code is viewed through the browsers View Source feature?

I know it is possible to obfuscate the code, but I would prefer it being hidden from the view source feature.

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

marked as duplicate by Matt javascript
Users with the javascript badge can single-handedly close javascript questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Jun 10 '14 at 18:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

it clientside and so it will reside on every clients ( browsers )

– naveen
Jul 29 '11 at 6:14

8

Why would you want to hide Javascript? It's not like you'd ever put any sensitive data that you don't want the user finding in it... Right?!

– Paulpro
Jul 29 '11 at 6:16

How would a browser know what Javascript to run?

– Wylie
Jul 29 '11 at 6:47

1

@PaulPRO has a good point -- why would you want to hide JavaScript? Anyone who wants to know what you're doing is ALWAYS going to be able to get your script with a few keystrokes. They won't just rely on View-Source. Anyone who doesn't know how to get a script is likely not going to be interested in it anyway.

– Stephen Chung
Jul 30 '11 at 5:25

stackoverflow.com/a/17468822/2450730

– cocco
Jul 4 '13 at 12:45

|
show 5 more comments

This question already has an answer here:

how to hide javascript code [duplicate]

4 answers

Is it possible to hide the Javascript code from the html of a webpage, when the source code is viewed through the browsers View Source feature?

I know it is possible to obfuscate the code, but I would prefer it being hidden from the view source feature.

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

marked as duplicate by Matt javascript
Users with the javascript badge can single-handedly close javascript questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Jun 10 '14 at 18:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

it clientside and so it will reside on every clients ( browsers )

– naveen
Jul 29 '11 at 6:14

8

Why would you want to hide Javascript? It's not like you'd ever put any sensitive data that you don't want the user finding in it... Right?!

– Paulpro
Jul 29 '11 at 6:16

How would a browser know what Javascript to run?

– Wylie
Jul 29 '11 at 6:47

1

@PaulPRO has a good point -- why would you want to hide JavaScript? Anyone who wants to know what you're doing is ALWAYS going to be able to get your script with a few keystrokes. They won't just rely on View-Source. Anyone who doesn't know how to get a script is likely not going to be interested in it anyway.

– Stephen Chung
Jul 30 '11 at 5:25

stackoverflow.com/a/17468822/2450730

– cocco
Jul 4 '13 at 12:45

|
show 5 more comments

This question already has an answer here:

how to hide javascript code [duplicate]

4 answers

Is it possible to hide the Javascript code from the html of a webpage, when the source code is viewed through the browsers View Source feature?

I know it is possible to obfuscate the code, but I would prefer it being hidden from the view source feature.

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

This question already has an answer here:

how to hide javascript code [duplicate]

4 answers

Is it possible to hide the Javascript code from the html of a webpage, when the source code is viewed through the browsers View Source feature?

I know it is possible to obfuscate the code, but I would prefer it being hidden from the view source feature.

This question already has an answer here:

how to hide javascript code [duplicate]

4 answers

javascript browser hide obfuscation

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

edited Jul 17 '15 at 22:08

durron597

27.5k11 gold badges76 silver badges138 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

asked Jul 29 '11 at 6:11

arun nair

1,53511 gold badges32 silver badges47 bronze badges

marked as duplicate by Matt javascript
Users with the javascript badge can single-handedly close javascript questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Jun 10 '14 at 18:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

marked as duplicate by Matt javascript
Users with the javascript badge can single-handedly close javascript questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Jun 10 '14 at 18:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

marked as duplicate by Matt javascript
Users with the javascript badge can single-handedly close javascript questions as duplicates and reopen them as needed.

StackExchange.ready(function()
if (StackExchange.options.isMobile) return;

$('.dupe-hammer-message-hover:not(.hover-bound)').each(function()
var $hover = $(this).addClass('hover-bound'),
$msg = $hover.siblings('.dupe-hammer-message');

$hover.hover(
function()
$hover.showInfoMessage('',
messageElement: $msg.clone().show(),
transient: false,
position: my: 'bottom left', at: 'top center', offsetTop: -7 ,
dismissable: false,
relativeToBody: true
);
,
function()
StackExchange.helpers.removeMessages();

);
);
);
Jun 10 '14 at 18:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

it clientside and so it will reside on every clients ( browsers )

– naveen
Jul 29 '11 at 6:14

8

Why would you want to hide Javascript? It's not like you'd ever put any sensitive data that you don't want the user finding in it... Right?!

– Paulpro
Jul 29 '11 at 6:16

How would a browser know what Javascript to run?

– Wylie
Jul 29 '11 at 6:47

1

@PaulPRO has a good point -- why would you want to hide JavaScript? Anyone who wants to know what you're doing is ALWAYS going to be able to get your script with a few keystrokes. They won't just rely on View-Source. Anyone who doesn't know how to get a script is likely not going to be interested in it anyway.

– Stephen Chung
Jul 30 '11 at 5:25

stackoverflow.com/a/17468822/2450730

– cocco
Jul 4 '13 at 12:45

|
show 5 more comments

1

it clientside and so it will reside on every clients ( browsers )

– naveen
Jul 29 '11 at 6:14

8

Why would you want to hide Javascript? It's not like you'd ever put any sensitive data that you don't want the user finding in it... Right?!

– Paulpro
Jul 29 '11 at 6:16

How would a browser know what Javascript to run?

– Wylie
Jul 29 '11 at 6:47

1

@PaulPRO has a good point -- why would you want to hide JavaScript? Anyone who wants to know what you're doing is ALWAYS going to be able to get your script with a few keystrokes. They won't just rely on View-Source. Anyone who doesn't know how to get a script is likely not going to be interested in it anyway.

– Stephen Chung
Jul 30 '11 at 5:25

stackoverflow.com/a/17468822/2450730

– cocco
Jul 4 '13 at 12:45

it clientside and so it will reside on every clients ( browsers )

– naveen
Jul 29 '11 at 6:14

Why would you want to hide Javascript? It's not like you'd ever put any sensitive data that you don't want the user finding in it... Right?!

– Paulpro
Jul 29 '11 at 6:16

How would a browser know what Javascript to run?

– Wylie
Jul 29 '11 at 6:47

@PaulPRO has a good point -- why would you want to hide JavaScript? Anyone who wants to know what you're doing is ALWAYS going to be able to get your script with a few keystrokes. They won't just rely on View-Source. Anyone who doesn't know how to get a script is likely not going to be interested in it anyway.

– Stephen Chung
Jul 30 '11 at 5:25

stackoverflow.com/a/17468822/2450730

– cocco
Jul 4 '13 at 12:45

|
show 5 more comments

9 Answers
9

active

oldest

votes

114

I'm not sure anyone else actually addressed your question directly which is code being viewed from the browser's View Source command.

As other have said, there is no way to protect javascript intended to run in a browser from a determined viewer. If the browser can run it, then any determined person can view/run it also.

But, if you put your javascript in an external javascript file that is included with:

<script type="text/javascript" src="http://mydomain.com/xxxx.js"></script>

tags, then the javascript code won't be immediately visible with the View Source command - only the script tag itself will be visible that way. That doesn't mean that someone can't just load that external javascript file to see it, but you did ask how to keep it out of the browser's View Source command and this will do it.

If you wanted to really make it more work to view the source, you would do all of the following:

Put it in an external .js file.

Obfuscate the file so that most native variable names are replaced with short versions, so that all unneeded whitespace is removed, so it can't be read without further processing, etc...

Dynamically include the .js file by programmatically adding script tags (like Google Analytics does). This will make it even more difficult to get to the source code from the View Source command as there will be no easy link to click on there.

Put as much interesting logic that you want to protect on the server that you retrieve via ajax calls rather than do local processing.

With all that said, I think you should focus on performance, reliability and making your app great. If you absolutely have to protect some algorithm, put it on the server, but other than that, compete on being the best at you do, not by having secrets. That's ultimately how success works on the web anyway.

edited Jul 29 '11 at 7:13

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

25

Perfectly visible via View Source… view-source:http://mydomain.com/xxxx.js

– Quentin
Jul 29 '11 at 6:43

2

Nice way to address the question directly. Using JavaScript to generate the <script> would keep it out of the View Source better (still visible under the live DOM) -- that is, it can't just be "right clicked on" in the Source View. It might be possible for said <script> element to be removed once the JavaScript is executed making it slightly more cumbersome (but not impossible) to get the original code... of course the net traffic will show up very readily in Firebug or similar ;-)

– user166390
Jul 29 '11 at 6:48

3

@Quentin - your view-source URL is silly - that's not what's being asked or proposed here. Any person can view the code. I've said that as much as anyone else. The question is only how easy it is and, per the specific question asked, how visible it is when someone does View Source? My suggestion makes it one step removed from View Source - that's all, but it's a valid extra step.

– jfriend00
Jul 29 '11 at 7:09

1

Use Encode.js : encodejs.devincity.com

– nachshon f
Apr 21 '16 at 15:46

2

awesome out the box thinking, well done sir

– Aaron Matthews
Jan 17 '18 at 8:53

|
show 3 more comments

No, it isn't possible.

If you don't give it to the browser, then the browser doesn't have it.

If you do, then it (or an easily followed reference to it) forms part of the source.

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

4

I'm not sure this answer really answered the question being asked (even though it got 10 upvotes in 15 mins). They asked how to keep the code out of the browsers View Source command. That is possible. See my answer below. They didn't ask how to keep the code from being viewed by a determined hacker.

– jfriend00
Jul 29 '11 at 6:32

8

It doesn't take much in the way of determination to click the link in the View Source for an HTML document to get to the View Source for the script.

– Quentin
Jul 29 '11 at 6:44

In my view question has not been interpreted correctly. Creating a JS file is common, what user want here (I think) is how to hide any JS variable value when any one choose option "view page source". +1 from my side.

– shaILU
Sep 2 '15 at 5:13

This answer doesn't make any sense. it is better to give a suggestion here. Better option to use an external file.

– Lalit Mohan
Aug 8 at 10:11

add a comment
|

Use Html Encrypter The part of the Head which has

<link rel="stylesheet" href="styles/css.css" type="text/css" media="screen" />
<script type="text/javascript" src="script/js.js" language="javascript"></script>

copy and paste it to HTML Encrypter and the Result will goes like this
and paste it the location where you cut the above sample

<Script Language='Javascript'>
<!-- HTML Encryption provided by iWEBTOOL.com -->
<!--
document.write(unescape('%3C%6C%69%6E%6B%20%72%65%6C%3D%22%73%74%79%6C%65%73%68%65%65%74%22%20%68%72%65%66%3D%22%73%74%79%6C%65%73%2F%63%73%73%2E%63%73%73%22%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%20%6D%65%64%69%61%3D%22%73%63%72%65%65%6E%22%20%2F%3E%0A%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%73%63%72%69%70%74%2F%6A%73%2E%6A%73%22%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%3C%2F%73%63%72%69%70%74%3E%0A'));
//-->

HTML ENCRYPTER
Note: if you have a java script in your page try to export to .js file and make it like as the example above.

And Also this Encrypter is not always working in some code that will make ur website messed up... Select the best part you want to hide like for example in <form> </form>

This can be reverse by advance user but not all noob like me knows it.

Hope this will help

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

3

Your provided link is not open give 404 code error.

– Akash Limbani
Nov 21 '18 at 13:34

add a comment
|

My solution is inspired from the last comment. This is the code of invisible.html

<script src="http://code.jquery.com/jquery-1.8.2.js"></script>
<script type="text/javascript" src="invisible_debut.js" ></script>
<body>
</body>

The clear code of invisible_debut.js is:

$(document).ready(function () 
var ga = document.createElement("script"); //ga is to remember Google Analytics ;-)
ga.type = 'text/javascript';
ga.src = 'invisible.js';
ga.id = 'invisible';
document.body.appendChild(ga);
$('#invisible').remove(););

Notice that at the end I'm removing the created script.
invisible.js is:

$(document).ready(function()
 alert('try to find in the source the js script which did this alert!');
 document.write('It disappeared, my dear!'););

invisible.js doesn't appear in the console, because it has been removed and never in the source code because created by javascript.

Concerning invisible_debut.js, I obfuscated it, which means that it is very complicated to find the url of invisible.js. Not perfect, but enought hard for a normal hacker.

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

3

The strange thing is that I followed exactly the steps and I'm able to find invisible.js in sources. Chrome Version 34.0.1847.131 m

– Boyang
Apr 30 '14 at 9:59

@Boyang, its just not appear in console, but if we know the path, we still able to find it.

– Panadol Chong
Aug 2 at 10:33

add a comment
|

'Is not possible!'

Oh yes it is ....

//------------------------------
function unloadJS(scriptName) 
 var head = document.getElementsByTagName('head').item(0);
 var js = document.getElementById(scriptName);
 js.parentNode.removeChild(js);



//----------------------
function unloadAllJS() 
 var jsArray = new Array();
 jsArray = document.getElementsByTagName('script');
 for (i = 0; i < jsArray.length; i++)
 if (jsArray[i].id)
 unloadJS(jsArray[i].id)
 else
 jsArray[i].parentNode.removeChild(jsArray[i]);

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

3

Very good answer. It indeed hide the javascript usage, however, only when you use the Element Inspector/Developer Tools, you can still see if you look via View Source. (At least on chrome)

– Patrick Bard
Feb 13 '14 at 5:19

is the variable "head" redundant here or does it serve some important function?

– Master James
Sep 29 '16 at 9:27

1

it hides it only partially... any exposed function (global) can be shown by dev tools and it will appear as an anonymous function but dev tools tells you everything including where it was loaded from

– Zibri
Mar 5 at 11:33

this only hides it from source.. an anynomous function would just do the same: fetch("SCRIPT TO HIDE").then(function(t) return t.text()).then(c=>self[atob("ZXZhbA")](c))

– Zibri
Mar 5 at 11:48

add a comment
|

I'm not sure there's a way to hide that information. No matter what you do to obfuscate or hide whatever you're doing in JavaScript, it still comes down to the fact that your browser needs to load it in order to use it. Modern browsers have web debugging/analysis tools out of the box that make extracting and viewing scripts trivial (just hit F12 in Chrome, for example).

If you're worried about exposing some kind of trade secret or algorithm, then your only recourse is to encapsulate that logic in a web service call and have your page invoke that functionality via AJAX.

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

add a comment
|

I think I found a solution to hide certain JavaScript codes in the view source of the browser. But you have to use jQuery to do this.

For example:

In your index.php

<head>
<script language = 'javascript' src = 'jquery.js'></script>
<script language = 'javascript' src = 'js.js'></script>
</head>

<body>
<a href = "javascript:void(null)" onclick = "loaddiv()">Click me.</a>

<div id = "content">
</div>

</body>

You load a file in the html/php body called by a jquery function in the js.js file.

js.js

function loaddiv()
$('#content').load('content.php');

Here's the trick.

In your content.php file put another head tag then call another js file from there.

content.php

<head>
<script language = 'javascript' src = 'js2.js'></script>
</head>

<a href = "javascript:void(null)" onclick = "loaddiv2()">Click me too.</a>

<div id = "content2">
</div>

in the js2.js file create any function you want.

example:

js2.js

function loaddiv2()
$('#content2').load('content2.php');

content2.php

<?php
echo "Test 2";
?>

Please follow link then copy paste it in the filename of jquery.js

http://dl.dropbox.com/u/36557803/jquery.js

I hope this helps.

edited Nov 9 '12 at 2:50

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

This will provide only minimal protection. It's trivial to go to the browser's dev tools' network tab and see all downloaded scripts, including those loaded through Ajax.

– JJJ
Jun 14 '13 at 7:03

add a comment
|

You could use document.write.

Without jQuery

<!DOCTYPE html>
<html>
<head><meta charset=utf-8></head>
<body onload="document.write('<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>');">
</body></html>

Or with jQuery

$(function () 
 document.write("<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>")
);

edited Apr 17 '16 at 22:41

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

add a comment
|

Is not possbile!

The only way is to obfuscate javascript or minify your javascript which makes it hard for the end user to reverse engineer. however its not impossible to reverse engineer.

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

add a comment
|

9 Answers
9

active

oldest

votes

9 Answers
9

active

oldest

votes

114

I'm not sure anyone else actually addressed your question directly which is code being viewed from the browser's View Source command.

As other have said, there is no way to protect javascript intended to run in a browser from a determined viewer. If the browser can run it, then any determined person can view/run it also.

But, if you put your javascript in an external javascript file that is included with:

<script type="text/javascript" src="http://mydomain.com/xxxx.js"></script>

If you wanted to really make it more work to view the source, you would do all of the following:

Put it in an external .js file.

Obfuscate the file so that most native variable names are replaced with short versions, so that all unneeded whitespace is removed, so it can't be read without further processing, etc...

Dynamically include the .js file by programmatically adding script tags (like Google Analytics does). This will make it even more difficult to get to the source code from the View Source command as there will be no easy link to click on there.

Put as much interesting logic that you want to protect on the server that you retrieve via ajax calls rather than do local processing.

edited Jul 29 '11 at 7:13

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

25

Perfectly visible via View Source… view-source:http://mydomain.com/xxxx.js

– Quentin
Jul 29 '11 at 6:43

2

Nice way to address the question directly. Using JavaScript to generate the <script> would keep it out of the View Source better (still visible under the live DOM) -- that is, it can't just be "right clicked on" in the Source View. It might be possible for said <script> element to be removed once the JavaScript is executed making it slightly more cumbersome (but not impossible) to get the original code... of course the net traffic will show up very readily in Firebug or similar ;-)

– user166390
Jul 29 '11 at 6:48

3

@Quentin - your view-source URL is silly - that's not what's being asked or proposed here. Any person can view the code. I've said that as much as anyone else. The question is only how easy it is and, per the specific question asked, how visible it is when someone does View Source? My suggestion makes it one step removed from View Source - that's all, but it's a valid extra step.

– jfriend00
Jul 29 '11 at 7:09

1

Use Encode.js : encodejs.devincity.com

– nachshon f
Apr 21 '16 at 15:46

2

awesome out the box thinking, well done sir

– Aaron Matthews
Jan 17 '18 at 8:53

|
show 3 more comments

114

I'm not sure anyone else actually addressed your question directly which is code being viewed from the browser's View Source command.

As other have said, there is no way to protect javascript intended to run in a browser from a determined viewer. If the browser can run it, then any determined person can view/run it also.

But, if you put your javascript in an external javascript file that is included with:

<script type="text/javascript" src="http://mydomain.com/xxxx.js"></script>

If you wanted to really make it more work to view the source, you would do all of the following:

Put it in an external .js file.

Obfuscate the file so that most native variable names are replaced with short versions, so that all unneeded whitespace is removed, so it can't be read without further processing, etc...

Dynamically include the .js file by programmatically adding script tags (like Google Analytics does). This will make it even more difficult to get to the source code from the View Source command as there will be no easy link to click on there.

Put as much interesting logic that you want to protect on the server that you retrieve via ajax calls rather than do local processing.

edited Jul 29 '11 at 7:13

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

25

Perfectly visible via View Source… view-source:http://mydomain.com/xxxx.js

– Quentin
Jul 29 '11 at 6:43

2

Nice way to address the question directly. Using JavaScript to generate the <script> would keep it out of the View Source better (still visible under the live DOM) -- that is, it can't just be "right clicked on" in the Source View. It might be possible for said <script> element to be removed once the JavaScript is executed making it slightly more cumbersome (but not impossible) to get the original code... of course the net traffic will show up very readily in Firebug or similar ;-)

– user166390
Jul 29 '11 at 6:48

3

@Quentin - your view-source URL is silly - that's not what's being asked or proposed here. Any person can view the code. I've said that as much as anyone else. The question is only how easy it is and, per the specific question asked, how visible it is when someone does View Source? My suggestion makes it one step removed from View Source - that's all, but it's a valid extra step.

– jfriend00
Jul 29 '11 at 7:09

1

Use Encode.js : encodejs.devincity.com

– nachshon f
Apr 21 '16 at 15:46

2

awesome out the box thinking, well done sir

– Aaron Matthews
Jan 17 '18 at 8:53

|
show 3 more comments

114

I'm not sure anyone else actually addressed your question directly which is code being viewed from the browser's View Source command.

As other have said, there is no way to protect javascript intended to run in a browser from a determined viewer. If the browser can run it, then any determined person can view/run it also.

But, if you put your javascript in an external javascript file that is included with:

<script type="text/javascript" src="http://mydomain.com/xxxx.js"></script>

If you wanted to really make it more work to view the source, you would do all of the following:

Put it in an external .js file.

Obfuscate the file so that most native variable names are replaced with short versions, so that all unneeded whitespace is removed, so it can't be read without further processing, etc...

Dynamically include the .js file by programmatically adding script tags (like Google Analytics does). This will make it even more difficult to get to the source code from the View Source command as there will be no easy link to click on there.

Put as much interesting logic that you want to protect on the server that you retrieve via ajax calls rather than do local processing.

edited Jul 29 '11 at 7:13

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

I'm not sure anyone else actually addressed your question directly which is code being viewed from the browser's View Source command.

As other have said, there is no way to protect javascript intended to run in a browser from a determined viewer. If the browser can run it, then any determined person can view/run it also.

But, if you put your javascript in an external javascript file that is included with:

<script type="text/javascript" src="http://mydomain.com/xxxx.js"></script>

If you wanted to really make it more work to view the source, you would do all of the following:

Put it in an external .js file.

Obfuscate the file so that most native variable names are replaced with short versions, so that all unneeded whitespace is removed, so it can't be read without further processing, etc...

Dynamically include the .js file by programmatically adding script tags (like Google Analytics does). This will make it even more difficult to get to the source code from the View Source command as there will be no easy link to click on there.

Put as much interesting logic that you want to protect on the server that you retrieve via ajax calls rather than do local processing.

edited Jul 29 '11 at 7:13

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

edited Jul 29 '11 at 7:13

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

answered Jul 29 '11 at 6:20

jfriend00

466k61 gold badges624 silver badges661 bronze badges

25

Perfectly visible via View Source… view-source:http://mydomain.com/xxxx.js

– Quentin
Jul 29 '11 at 6:43

2

Nice way to address the question directly. Using JavaScript to generate the <script> would keep it out of the View Source better (still visible under the live DOM) -- that is, it can't just be "right clicked on" in the Source View. It might be possible for said <script> element to be removed once the JavaScript is executed making it slightly more cumbersome (but not impossible) to get the original code... of course the net traffic will show up very readily in Firebug or similar ;-)

– user166390
Jul 29 '11 at 6:48

3

@Quentin - your view-source URL is silly - that's not what's being asked or proposed here. Any person can view the code. I've said that as much as anyone else. The question is only how easy it is and, per the specific question asked, how visible it is when someone does View Source? My suggestion makes it one step removed from View Source - that's all, but it's a valid extra step.

– jfriend00
Jul 29 '11 at 7:09

1

Use Encode.js : encodejs.devincity.com

– nachshon f
Apr 21 '16 at 15:46

2

awesome out the box thinking, well done sir

– Aaron Matthews
Jan 17 '18 at 8:53

|
show 3 more comments

25

Perfectly visible via View Source… view-source:http://mydomain.com/xxxx.js

– Quentin
Jul 29 '11 at 6:43

2

Nice way to address the question directly. Using JavaScript to generate the <script> would keep it out of the View Source better (still visible under the live DOM) -- that is, it can't just be "right clicked on" in the Source View. It might be possible for said <script> element to be removed once the JavaScript is executed making it slightly more cumbersome (but not impossible) to get the original code... of course the net traffic will show up very readily in Firebug or similar ;-)

– user166390
Jul 29 '11 at 6:48

3

@Quentin - your view-source URL is silly - that's not what's being asked or proposed here. Any person can view the code. I've said that as much as anyone else. The question is only how easy it is and, per the specific question asked, how visible it is when someone does View Source? My suggestion makes it one step removed from View Source - that's all, but it's a valid extra step.

– jfriend00
Jul 29 '11 at 7:09

1

Use Encode.js : encodejs.devincity.com

– nachshon f
Apr 21 '16 at 15:46

2

awesome out the box thinking, well done sir

– Aaron Matthews
Jan 17 '18 at 8:53

Perfectly visible via View Source… view-source:http://mydomain.com/xxxx.js

– Quentin
Jul 29 '11 at 6:43

Nice way to address the question directly. Using JavaScript to generate the <script> would keep it out of the View Source better (still visible under the live DOM) -- that is, it can't just be "right clicked on" in the Source View. It might be possible for said <script> element to be removed once the JavaScript is executed making it slightly more cumbersome (but not impossible) to get the original code... of course the net traffic will show up very readily in Firebug or similar ;-)

– user166390
Jul 29 '11 at 6:48

@Quentin - your view-source URL is silly - that's not what's being asked or proposed here. Any person can view the code. I've said that as much as anyone else. The question is only how easy it is and, per the specific question asked, how visible it is when someone does View Source? My suggestion makes it one step removed from View Source - that's all, but it's a valid extra step.

– jfriend00
Jul 29 '11 at 7:09

Use Encode.js : encodejs.devincity.com

– nachshon f
Apr 21 '16 at 15:46

awesome out the box thinking, well done sir

– Aaron Matthews
Jan 17 '18 at 8:53

|
show 3 more comments

No, it isn't possible.

If you don't give it to the browser, then the browser doesn't have it.

If you do, then it (or an easily followed reference to it) forms part of the source.

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

4

I'm not sure this answer really answered the question being asked (even though it got 10 upvotes in 15 mins). They asked how to keep the code out of the browsers View Source command. That is possible. See my answer below. They didn't ask how to keep the code from being viewed by a determined hacker.

– jfriend00
Jul 29 '11 at 6:32

8

It doesn't take much in the way of determination to click the link in the View Source for an HTML document to get to the View Source for the script.

– Quentin
Jul 29 '11 at 6:44

In my view question has not been interpreted correctly. Creating a JS file is common, what user want here (I think) is how to hide any JS variable value when any one choose option "view page source". +1 from my side.

– shaILU
Sep 2 '15 at 5:13

This answer doesn't make any sense. it is better to give a suggestion here. Better option to use an external file.

– Lalit Mohan
Aug 8 at 10:11

add a comment
|

No, it isn't possible.

If you don't give it to the browser, then the browser doesn't have it.

If you do, then it (or an easily followed reference to it) forms part of the source.

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

4

I'm not sure this answer really answered the question being asked (even though it got 10 upvotes in 15 mins). They asked how to keep the code out of the browsers View Source command. That is possible. See my answer below. They didn't ask how to keep the code from being viewed by a determined hacker.

– jfriend00
Jul 29 '11 at 6:32

8

It doesn't take much in the way of determination to click the link in the View Source for an HTML document to get to the View Source for the script.

– Quentin
Jul 29 '11 at 6:44

In my view question has not been interpreted correctly. Creating a JS file is common, what user want here (I think) is how to hide any JS variable value when any one choose option "view page source". +1 from my side.

– shaILU
Sep 2 '15 at 5:13

This answer doesn't make any sense. it is better to give a suggestion here. Better option to use an external file.

– Lalit Mohan
Aug 8 at 10:11

add a comment
|

No, it isn't possible.

If you don't give it to the browser, then the browser doesn't have it.

If you do, then it (or an easily followed reference to it) forms part of the source.

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

No, it isn't possible.

If you don't give it to the browser, then the browser doesn't have it.

If you do, then it (or an easily followed reference to it) forms part of the source.

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

answered Jul 29 '11 at 6:13

Quentin

687k80 gold badges931 silver badges1087 bronze badges

4

I'm not sure this answer really answered the question being asked (even though it got 10 upvotes in 15 mins). They asked how to keep the code out of the browsers View Source command. That is possible. See my answer below. They didn't ask how to keep the code from being viewed by a determined hacker.

– jfriend00
Jul 29 '11 at 6:32

8

It doesn't take much in the way of determination to click the link in the View Source for an HTML document to get to the View Source for the script.

– Quentin
Jul 29 '11 at 6:44

In my view question has not been interpreted correctly. Creating a JS file is common, what user want here (I think) is how to hide any JS variable value when any one choose option "view page source". +1 from my side.

– shaILU
Sep 2 '15 at 5:13

This answer doesn't make any sense. it is better to give a suggestion here. Better option to use an external file.

– Lalit Mohan
Aug 8 at 10:11

add a comment
|

4

I'm not sure this answer really answered the question being asked (even though it got 10 upvotes in 15 mins). They asked how to keep the code out of the browsers View Source command. That is possible. See my answer below. They didn't ask how to keep the code from being viewed by a determined hacker.

– jfriend00
Jul 29 '11 at 6:32

8

It doesn't take much in the way of determination to click the link in the View Source for an HTML document to get to the View Source for the script.

– Quentin
Jul 29 '11 at 6:44

In my view question has not been interpreted correctly. Creating a JS file is common, what user want here (I think) is how to hide any JS variable value when any one choose option "view page source". +1 from my side.

– shaILU
Sep 2 '15 at 5:13

This answer doesn't make any sense. it is better to give a suggestion here. Better option to use an external file.

– Lalit Mohan
Aug 8 at 10:11

I'm not sure this answer really answered the question being asked (even though it got 10 upvotes in 15 mins). They asked how to keep the code out of the browsers View Source command. That is possible. See my answer below. They didn't ask how to keep the code from being viewed by a determined hacker.

– jfriend00
Jul 29 '11 at 6:32

It doesn't take much in the way of determination to click the link in the View Source for an HTML document to get to the View Source for the script.

– Quentin
Jul 29 '11 at 6:44

In my view question has not been interpreted correctly. Creating a JS file is common, what user want here (I think) is how to hide any JS variable value when any one choose option "view page source". +1 from my side.

– shaILU
Sep 2 '15 at 5:13

This answer doesn't make any sense. it is better to give a suggestion here. Better option to use an external file.

– Lalit Mohan
Aug 8 at 10:11

add a comment
|

Use Html Encrypter The part of the Head which has

<link rel="stylesheet" href="styles/css.css" type="text/css" media="screen" />
<script type="text/javascript" src="script/js.js" language="javascript"></script>

copy and paste it to HTML Encrypter and the Result will goes like this
and paste it the location where you cut the above sample

<Script Language='Javascript'>
<!-- HTML Encryption provided by iWEBTOOL.com -->
<!--
document.write(unescape('%3C%6C%69%6E%6B%20%72%65%6C%3D%22%73%74%79%6C%65%73%68%65%65%74%22%20%68%72%65%66%3D%22%73%74%79%6C%65%73%2F%63%73%73%2E%63%73%73%22%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%20%6D%65%64%69%61%3D%22%73%63%72%65%65%6E%22%20%2F%3E%0A%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%73%63%72%69%70%74%2F%6A%73%2E%6A%73%22%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%3C%2F%73%63%72%69%70%74%3E%0A'));
//-->

HTML ENCRYPTER
Note: if you have a java script in your page try to export to .js file and make it like as the example above.

And Also this Encrypter is not always working in some code that will make ur website messed up... Select the best part you want to hide like for example in <form> </form>

This can be reverse by advance user but not all noob like me knows it.

Hope this will help

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

3

Your provided link is not open give 404 code error.

– Akash Limbani
Nov 21 '18 at 13:34

add a comment
|

Use Html Encrypter The part of the Head which has

<link rel="stylesheet" href="styles/css.css" type="text/css" media="screen" />
<script type="text/javascript" src="script/js.js" language="javascript"></script>

copy and paste it to HTML Encrypter and the Result will goes like this
and paste it the location where you cut the above sample

<Script Language='Javascript'>
<!-- HTML Encryption provided by iWEBTOOL.com -->
<!--
document.write(unescape('%3C%6C%69%6E%6B%20%72%65%6C%3D%22%73%74%79%6C%65%73%68%65%65%74%22%20%68%72%65%66%3D%22%73%74%79%6C%65%73%2F%63%73%73%2E%63%73%73%22%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%20%6D%65%64%69%61%3D%22%73%63%72%65%65%6E%22%20%2F%3E%0A%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%73%63%72%69%70%74%2F%6A%73%2E%6A%73%22%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%3C%2F%73%63%72%69%70%74%3E%0A'));
//-->

HTML ENCRYPTER
Note: if you have a java script in your page try to export to .js file and make it like as the example above.

And Also this Encrypter is not always working in some code that will make ur website messed up... Select the best part you want to hide like for example in <form> </form>

This can be reverse by advance user but not all noob like me knows it.

Hope this will help

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

3

Your provided link is not open give 404 code error.

– Akash Limbani
Nov 21 '18 at 13:34

add a comment
|

Use Html Encrypter The part of the Head which has

<link rel="stylesheet" href="styles/css.css" type="text/css" media="screen" />
<script type="text/javascript" src="script/js.js" language="javascript"></script>

copy and paste it to HTML Encrypter and the Result will goes like this
and paste it the location where you cut the above sample

<Script Language='Javascript'>
<!-- HTML Encryption provided by iWEBTOOL.com -->
<!--
document.write(unescape('%3C%6C%69%6E%6B%20%72%65%6C%3D%22%73%74%79%6C%65%73%68%65%65%74%22%20%68%72%65%66%3D%22%73%74%79%6C%65%73%2F%63%73%73%2E%63%73%73%22%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%20%6D%65%64%69%61%3D%22%73%63%72%65%65%6E%22%20%2F%3E%0A%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%73%63%72%69%70%74%2F%6A%73%2E%6A%73%22%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%3C%2F%73%63%72%69%70%74%3E%0A'));
//-->

HTML ENCRYPTER
Note: if you have a java script in your page try to export to .js file and make it like as the example above.

And Also this Encrypter is not always working in some code that will make ur website messed up... Select the best part you want to hide like for example in <form> </form>

This can be reverse by advance user but not all noob like me knows it.

Hope this will help

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

Use Html Encrypter The part of the Head which has

<link rel="stylesheet" href="styles/css.css" type="text/css" media="screen" />
<script type="text/javascript" src="script/js.js" language="javascript"></script>

copy and paste it to HTML Encrypter and the Result will goes like this
and paste it the location where you cut the above sample

<Script Language='Javascript'>
<!-- HTML Encryption provided by iWEBTOOL.com -->
<!--
document.write(unescape('%3C%6C%69%6E%6B%20%72%65%6C%3D%22%73%74%79%6C%65%73%68%65%65%74%22%20%68%72%65%66%3D%22%73%74%79%6C%65%73%2F%63%73%73%2E%63%73%73%22%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%20%6D%65%64%69%61%3D%22%73%63%72%65%65%6E%22%20%2F%3E%0A%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%73%63%72%69%70%74%2F%6A%73%2E%6A%73%22%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%3C%2F%73%63%72%69%70%74%3E%0A'));
//-->

HTML ENCRYPTER
Note: if you have a java script in your page try to export to .js file and make it like as the example above.

And Also this Encrypter is not always working in some code that will make ur website messed up... Select the best part you want to hide like for example in <form> </form>

This can be reverse by advance user but not all noob like me knows it.

Hope this will help

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

edited Dec 15 '12 at 11:45

akjoshi

11.6k13 gold badges86 silver badges114 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

answered Dec 15 '12 at 11:23

HINAYUPAKS

1471 silver badge3 bronze badges

3

Your provided link is not open give 404 code error.

– Akash Limbani
Nov 21 '18 at 13:34

add a comment
|

3

Your provided link is not open give 404 code error.

– Akash Limbani
Nov 21 '18 at 13:34

Your provided link is not open give 404 code error.

– Akash Limbani
Nov 21 '18 at 13:34

add a comment
|

My solution is inspired from the last comment. This is the code of invisible.html

<script src="http://code.jquery.com/jquery-1.8.2.js"></script>
<script type="text/javascript" src="invisible_debut.js" ></script>
<body>
</body>

The clear code of invisible_debut.js is:

$(document).ready(function () 
var ga = document.createElement("script"); //ga is to remember Google Analytics ;-)
ga.type = 'text/javascript';
ga.src = 'invisible.js';
ga.id = 'invisible';
document.body.appendChild(ga);
$('#invisible').remove(););

Notice that at the end I'm removing the created script.
invisible.js is:

$(document).ready(function()
 alert('try to find in the source the js script which did this alert!');
 document.write('It disappeared, my dear!'););

invisible.js doesn't appear in the console, because it has been removed and never in the source code because created by javascript.

Concerning invisible_debut.js, I obfuscated it, which means that it is very complicated to find the url of invisible.js. Not perfect, but enought hard for a normal hacker.

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

3

The strange thing is that I followed exactly the steps and I'm able to find invisible.js in sources. Chrome Version 34.0.1847.131 m

– Boyang
Apr 30 '14 at 9:59

@Boyang, its just not appear in console, but if we know the path, we still able to find it.

– Panadol Chong
Aug 2 at 10:33

add a comment
|

My solution is inspired from the last comment. This is the code of invisible.html

<script src="http://code.jquery.com/jquery-1.8.2.js"></script>
<script type="text/javascript" src="invisible_debut.js" ></script>
<body>
</body>

The clear code of invisible_debut.js is:

$(document).ready(function () 
var ga = document.createElement("script"); //ga is to remember Google Analytics ;-)
ga.type = 'text/javascript';
ga.src = 'invisible.js';
ga.id = 'invisible';
document.body.appendChild(ga);
$('#invisible').remove(););

Notice that at the end I'm removing the created script.
invisible.js is:

$(document).ready(function()
 alert('try to find in the source the js script which did this alert!');
 document.write('It disappeared, my dear!'););

invisible.js doesn't appear in the console, because it has been removed and never in the source code because created by javascript.

Concerning invisible_debut.js, I obfuscated it, which means that it is very complicated to find the url of invisible.js. Not perfect, but enought hard for a normal hacker.

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

3

The strange thing is that I followed exactly the steps and I'm able to find invisible.js in sources. Chrome Version 34.0.1847.131 m

– Boyang
Apr 30 '14 at 9:59

@Boyang, its just not appear in console, but if we know the path, we still able to find it.

– Panadol Chong
Aug 2 at 10:33

add a comment
|

My solution is inspired from the last comment. This is the code of invisible.html

<script src="http://code.jquery.com/jquery-1.8.2.js"></script>
<script type="text/javascript" src="invisible_debut.js" ></script>
<body>
</body>

The clear code of invisible_debut.js is:

$(document).ready(function () 
var ga = document.createElement("script"); //ga is to remember Google Analytics ;-)
ga.type = 'text/javascript';
ga.src = 'invisible.js';
ga.id = 'invisible';
document.body.appendChild(ga);
$('#invisible').remove(););

Notice that at the end I'm removing the created script.
invisible.js is:

$(document).ready(function()
 alert('try to find in the source the js script which did this alert!');
 document.write('It disappeared, my dear!'););

invisible.js doesn't appear in the console, because it has been removed and never in the source code because created by javascript.

Concerning invisible_debut.js, I obfuscated it, which means that it is very complicated to find the url of invisible.js. Not perfect, but enought hard for a normal hacker.

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

My solution is inspired from the last comment. This is the code of invisible.html

<script src="http://code.jquery.com/jquery-1.8.2.js"></script>
<script type="text/javascript" src="invisible_debut.js" ></script>
<body>
</body>

The clear code of invisible_debut.js is:

$(document).ready(function () 
var ga = document.createElement("script"); //ga is to remember Google Analytics ;-)
ga.type = 'text/javascript';
ga.src = 'invisible.js';
ga.id = 'invisible';
document.body.appendChild(ga);
$('#invisible').remove(););

Notice that at the end I'm removing the created script.
invisible.js is:

$(document).ready(function()
 alert('try to find in the source the js script which did this alert!');
 document.write('It disappeared, my dear!'););

invisible.js doesn't appear in the console, because it has been removed and never in the source code because created by javascript.

Concerning invisible_debut.js, I obfuscated it, which means that it is very complicated to find the url of invisible.js. Not perfect, but enought hard for a normal hacker.

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

answered Nov 19 '13 at 22:33

Armand Arapian

1511 silver badge2 bronze badges

3

The strange thing is that I followed exactly the steps and I'm able to find invisible.js in sources. Chrome Version 34.0.1847.131 m

– Boyang
Apr 30 '14 at 9:59

@Boyang, its just not appear in console, but if we know the path, we still able to find it.

– Panadol Chong
Aug 2 at 10:33

add a comment
|

3

The strange thing is that I followed exactly the steps and I'm able to find invisible.js in sources. Chrome Version 34.0.1847.131 m

– Boyang
Apr 30 '14 at 9:59

@Boyang, its just not appear in console, but if we know the path, we still able to find it.

– Panadol Chong
Aug 2 at 10:33

The strange thing is that I followed exactly the steps and I'm able to find invisible.js in sources. Chrome Version 34.0.1847.131 m

– Boyang
Apr 30 '14 at 9:59

@Boyang, its just not appear in console, but if we know the path, we still able to find it.

– Panadol Chong
Aug 2 at 10:33

add a comment
|

'Is not possible!'

Oh yes it is ....

//------------------------------
function unloadJS(scriptName) 
 var head = document.getElementsByTagName('head').item(0);
 var js = document.getElementById(scriptName);
 js.parentNode.removeChild(js);



//----------------------
function unloadAllJS() 
 var jsArray = new Array();
 jsArray = document.getElementsByTagName('script');
 for (i = 0; i < jsArray.length; i++)
 if (jsArray[i].id)
 unloadJS(jsArray[i].id)
 else
 jsArray[i].parentNode.removeChild(jsArray[i]);

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

3

Very good answer. It indeed hide the javascript usage, however, only when you use the Element Inspector/Developer Tools, you can still see if you look via View Source. (At least on chrome)

– Patrick Bard
Feb 13 '14 at 5:19

is the variable "head" redundant here or does it serve some important function?

– Master James
Sep 29 '16 at 9:27

1

it hides it only partially... any exposed function (global) can be shown by dev tools and it will appear as an anonymous function but dev tools tells you everything including where it was loaded from

– Zibri
Mar 5 at 11:33

this only hides it from source.. an anynomous function would just do the same: fetch("SCRIPT TO HIDE").then(function(t) return t.text()).then(c=>self[atob("ZXZhbA")](c))

– Zibri
Mar 5 at 11:48

add a comment
|

'Is not possible!'

Oh yes it is ....

//------------------------------
function unloadJS(scriptName) 
 var head = document.getElementsByTagName('head').item(0);
 var js = document.getElementById(scriptName);
 js.parentNode.removeChild(js);



//----------------------
function unloadAllJS() 
 var jsArray = new Array();
 jsArray = document.getElementsByTagName('script');
 for (i = 0; i < jsArray.length; i++)
 if (jsArray[i].id)
 unloadJS(jsArray[i].id)
 else
 jsArray[i].parentNode.removeChild(jsArray[i]);

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

3

Very good answer. It indeed hide the javascript usage, however, only when you use the Element Inspector/Developer Tools, you can still see if you look via View Source. (At least on chrome)

– Patrick Bard
Feb 13 '14 at 5:19

is the variable "head" redundant here or does it serve some important function?

– Master James
Sep 29 '16 at 9:27

1

it hides it only partially... any exposed function (global) can be shown by dev tools and it will appear as an anonymous function but dev tools tells you everything including where it was loaded from

– Zibri
Mar 5 at 11:33

this only hides it from source.. an anynomous function would just do the same: fetch("SCRIPT TO HIDE").then(function(t) return t.text()).then(c=>self[atob("ZXZhbA")](c))

– Zibri
Mar 5 at 11:48

add a comment
|

'Is not possible!'

Oh yes it is ....

//------------------------------
function unloadJS(scriptName) 
 var head = document.getElementsByTagName('head').item(0);
 var js = document.getElementById(scriptName);
 js.parentNode.removeChild(js);



//----------------------
function unloadAllJS() 
 var jsArray = new Array();
 jsArray = document.getElementsByTagName('script');
 for (i = 0; i < jsArray.length; i++)
 if (jsArray[i].id)
 unloadJS(jsArray[i].id)
 else
 jsArray[i].parentNode.removeChild(jsArray[i]);

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

'Is not possible!'

Oh yes it is ....

//------------------------------
function unloadJS(scriptName) 
 var head = document.getElementsByTagName('head').item(0);
 var js = document.getElementById(scriptName);
 js.parentNode.removeChild(js);



//----------------------
function unloadAllJS() 
 var jsArray = new Array();
 jsArray = document.getElementsByTagName('script');
 for (i = 0; i < jsArray.length; i++)
 if (jsArray[i].id)
 unloadJS(jsArray[i].id)
 else
 jsArray[i].parentNode.removeChild(jsArray[i]);

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

answered Jan 24 '13 at 6:55

Addinall

1421 silver badge10 bronze badges

3

Very good answer. It indeed hide the javascript usage, however, only when you use the Element Inspector/Developer Tools, you can still see if you look via View Source. (At least on chrome)

– Patrick Bard
Feb 13 '14 at 5:19

is the variable "head" redundant here or does it serve some important function?

– Master James
Sep 29 '16 at 9:27

1

it hides it only partially... any exposed function (global) can be shown by dev tools and it will appear as an anonymous function but dev tools tells you everything including where it was loaded from

– Zibri
Mar 5 at 11:33

this only hides it from source.. an anynomous function would just do the same: fetch("SCRIPT TO HIDE").then(function(t) return t.text()).then(c=>self[atob("ZXZhbA")](c))

– Zibri
Mar 5 at 11:48

add a comment
|

3

Very good answer. It indeed hide the javascript usage, however, only when you use the Element Inspector/Developer Tools, you can still see if you look via View Source. (At least on chrome)

– Patrick Bard
Feb 13 '14 at 5:19

is the variable "head" redundant here or does it serve some important function?

– Master James
Sep 29 '16 at 9:27

1

it hides it only partially... any exposed function (global) can be shown by dev tools and it will appear as an anonymous function but dev tools tells you everything including where it was loaded from

– Zibri
Mar 5 at 11:33

this only hides it from source.. an anynomous function would just do the same: fetch("SCRIPT TO HIDE").then(function(t) return t.text()).then(c=>self[atob("ZXZhbA")](c))

– Zibri
Mar 5 at 11:48

Very good answer. It indeed hide the javascript usage, however, only when you use the Element Inspector/Developer Tools, you can still see if you look via View Source. (At least on chrome)

– Patrick Bard
Feb 13 '14 at 5:19

is the variable "head" redundant here or does it serve some important function?

– Master James
Sep 29 '16 at 9:27

it hides it only partially... any exposed function (global) can be shown by dev tools and it will appear as an anonymous function but dev tools tells you everything including where it was loaded from

– Zibri
Mar 5 at 11:33

this only hides it from source.. an anynomous function would just do the same: fetch("SCRIPT TO HIDE").then(function(t) return t.text()).then(c=>self[atob("ZXZhbA")](c))

– Zibri
Mar 5 at 11:48

add a comment
|

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

add a comment
|

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

add a comment
|

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

answered Jul 29 '11 at 6:17

Mark Carpenter

11.3k21 gold badges85 silver badges140 bronze badges

add a comment
|

I think I found a solution to hide certain JavaScript codes in the view source of the browser. But you have to use jQuery to do this.

For example:

In your index.php

<head>
<script language = 'javascript' src = 'jquery.js'></script>
<script language = 'javascript' src = 'js.js'></script>
</head>

<body>
<a href = "javascript:void(null)" onclick = "loaddiv()">Click me.</a>

<div id = "content">
</div>

</body>

You load a file in the html/php body called by a jquery function in the js.js file.

js.js

function loaddiv()
$('#content').load('content.php');

Here's the trick.

In your content.php file put another head tag then call another js file from there.

content.php

<head>
<script language = 'javascript' src = 'js2.js'></script>
</head>

<a href = "javascript:void(null)" onclick = "loaddiv2()">Click me too.</a>

<div id = "content2">
</div>

in the js2.js file create any function you want.

example:

js2.js

function loaddiv2()
$('#content2').load('content2.php');

content2.php

<?php
echo "Test 2";
?>

Please follow link then copy paste it in the filename of jquery.js

http://dl.dropbox.com/u/36557803/jquery.js

I hope this helps.

edited Nov 9 '12 at 2:50

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

This will provide only minimal protection. It's trivial to go to the browser's dev tools' network tab and see all downloaded scripts, including those loaded through Ajax.

– JJJ
Jun 14 '13 at 7:03

add a comment
|

I think I found a solution to hide certain JavaScript codes in the view source of the browser. But you have to use jQuery to do this.

For example:

In your index.php

<head>
<script language = 'javascript' src = 'jquery.js'></script>
<script language = 'javascript' src = 'js.js'></script>
</head>

<body>
<a href = "javascript:void(null)" onclick = "loaddiv()">Click me.</a>

<div id = "content">
</div>

</body>

You load a file in the html/php body called by a jquery function in the js.js file.

js.js

function loaddiv()
$('#content').load('content.php');

Here's the trick.

In your content.php file put another head tag then call another js file from there.

content.php

<head>
<script language = 'javascript' src = 'js2.js'></script>
</head>

<a href = "javascript:void(null)" onclick = "loaddiv2()">Click me too.</a>

<div id = "content2">
</div>

in the js2.js file create any function you want.

example:

js2.js

function loaddiv2()
$('#content2').load('content2.php');

content2.php

<?php
echo "Test 2";
?>

Please follow link then copy paste it in the filename of jquery.js

http://dl.dropbox.com/u/36557803/jquery.js

I hope this helps.

edited Nov 9 '12 at 2:50

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

This will provide only minimal protection. It's trivial to go to the browser's dev tools' network tab and see all downloaded scripts, including those loaded through Ajax.

– JJJ
Jun 14 '13 at 7:03

add a comment
|

I think I found a solution to hide certain JavaScript codes in the view source of the browser. But you have to use jQuery to do this.

For example:

In your index.php

<head>
<script language = 'javascript' src = 'jquery.js'></script>
<script language = 'javascript' src = 'js.js'></script>
</head>

<body>
<a href = "javascript:void(null)" onclick = "loaddiv()">Click me.</a>

<div id = "content">
</div>

</body>

You load a file in the html/php body called by a jquery function in the js.js file.

js.js

function loaddiv()
$('#content').load('content.php');

Here's the trick.

In your content.php file put another head tag then call another js file from there.

content.php

<head>
<script language = 'javascript' src = 'js2.js'></script>
</head>

<a href = "javascript:void(null)" onclick = "loaddiv2()">Click me too.</a>

<div id = "content2">
</div>

in the js2.js file create any function you want.

example:

js2.js

function loaddiv2()
$('#content2').load('content2.php');

content2.php

<?php
echo "Test 2";
?>

Please follow link then copy paste it in the filename of jquery.js

http://dl.dropbox.com/u/36557803/jquery.js

I hope this helps.

edited Nov 9 '12 at 2:50

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

I think I found a solution to hide certain JavaScript codes in the view source of the browser. But you have to use jQuery to do this.

For example:

In your index.php

<head>
<script language = 'javascript' src = 'jquery.js'></script>
<script language = 'javascript' src = 'js.js'></script>
</head>

<body>
<a href = "javascript:void(null)" onclick = "loaddiv()">Click me.</a>

<div id = "content">
</div>

</body>

You load a file in the html/php body called by a jquery function in the js.js file.

js.js

function loaddiv()
$('#content').load('content.php');

Here's the trick.

In your content.php file put another head tag then call another js file from there.

content.php

<head>
<script language = 'javascript' src = 'js2.js'></script>
</head>

<a href = "javascript:void(null)" onclick = "loaddiv2()">Click me too.</a>

<div id = "content2">
</div>

in the js2.js file create any function you want.

example:

js2.js

function loaddiv2()
$('#content2').load('content2.php');

content2.php

<?php
echo "Test 2";
?>

Please follow link then copy paste it in the filename of jquery.js

http://dl.dropbox.com/u/36557803/jquery.js

I hope this helps.

edited Nov 9 '12 at 2:50

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

edited Nov 9 '12 at 2:50

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

answered Nov 7 '12 at 3:59

Jepp

671 silver badge3 bronze badges

This will provide only minimal protection. It's trivial to go to the browser's dev tools' network tab and see all downloaded scripts, including those loaded through Ajax.

– JJJ
Jun 14 '13 at 7:03

add a comment
|

This will provide only minimal protection. It's trivial to go to the browser's dev tools' network tab and see all downloaded scripts, including those loaded through Ajax.

– JJJ
Jun 14 '13 at 7:03

This will provide only minimal protection. It's trivial to go to the browser's dev tools' network tab and see all downloaded scripts, including those loaded through Ajax.

– JJJ
Jun 14 '13 at 7:03

add a comment
|

You could use document.write.

Without jQuery

<!DOCTYPE html>
<html>
<head><meta charset=utf-8></head>
<body onload="document.write('<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>');">
</body></html>

Or with jQuery

$(function () 
 document.write("<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>")
);

edited Apr 17 '16 at 22:41

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

add a comment
|

You could use document.write.

Without jQuery

<!DOCTYPE html>
<html>
<head><meta charset=utf-8></head>
<body onload="document.write('<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>');">
</body></html>

Or with jQuery

$(function () 
 document.write("<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>")
);

edited Apr 17 '16 at 22:41

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

add a comment
|

You could use document.write.

Without jQuery

<!DOCTYPE html>
<html>
<head><meta charset=utf-8></head>
<body onload="document.write('<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>');">
</body></html>

Or with jQuery

$(function () 
 document.write("<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>")
);

edited Apr 17 '16 at 22:41

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

You could use document.write.

Without jQuery

<!DOCTYPE html>
<html>
<head><meta charset=utf-8></head>
<body onload="document.write('<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>');">
</body></html>

Or with jQuery

$(function () 
 document.write("<!doctype html><html><head><meta charset=utf-8></head><body><p>You cannot find this in the page source. (Your page needs to be in this document.write argument.)</p></body></html>")
);

edited Apr 17 '16 at 22:41

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

edited Apr 17 '16 at 22:41

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

answered Dec 1 '13 at 20:35

Blue Sheep

3525 silver badges16 bronze badges

add a comment
|

Is not possbile!

The only way is to obfuscate javascript or minify your javascript which makes it hard for the end user to reverse engineer. however its not impossible to reverse engineer.

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

add a comment
|

Is not possbile!

The only way is to obfuscate javascript or minify your javascript which makes it hard for the end user to reverse engineer. however its not impossible to reverse engineer.

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

add a comment
|

Is not possbile!

The only way is to obfuscate javascript or minify your javascript which makes it hard for the end user to reverse engineer. however its not impossible to reverse engineer.

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

Is not possbile!

The only way is to obfuscate javascript or minify your javascript which makes it hard for the end user to reverse engineer. however its not impossible to reverse engineer.

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

edited Sep 27 '12 at 14:48

Chandra Sekhar Walajapet

2,42813 silver badges22 bronze badges

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

answered Aug 3 '12 at 9:11

gabriele brunori

111 bronze badge

add a comment
|

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Styjun

9 Answers
9

9 Answers
9

9 Answers
9

Popular posts from this blog

Kamusi Yaliyomo Aina za kamusi | Muundo wa kamusi | Faida za kamusi | Dhima ya picha katika kamusi | Marejeo | Tazama pia | Viungo vya nje | UrambazajiKuhusu kamusiGo-SwahiliWiki-KamusiKamusi ya Kiswahili na Kiingerezakuihariri na kuongeza habari

9 Answers 9

9 Answers 9

9 Answers 9

Popular posts from this blog

Kamusi Yaliyomo Aina za kamusi | Muundo wa kamusi | Faida za kamusi | Dhima ya picha katika kamusi | Marejeo | Tazama pia | Viungo vya nje | UrambazajiKuhusu kamusiGo-SwahiliWiki-KamusiKamusi ya Kiswahili na Kiingerezakuihariri na kuongeza habari

9 Answers
9

9 Answers
9

9 Answers
9