Less in plain sight.
Seeded string encodings and numeric reconstruction vary the output. Embedded decoding parameters are recoverable, not secret encryption keys.
ImplementedORIGINAL LUA PROTECTION TOOLKIT
Your logic.
A little less
transparent.
Raise the cost of reading your Lua. Keep control of the tradeoffs. Every build tells you what changed — and what didn’t.
Local-first. No source upload. No impossible promises.
local source → transformed output
CLEAR BOUNDARIES. REAL BUILDS.
constant encodingintegrity checks01 Transform locally02 Inspect the report03 Reference-check with CLI
THE WORKSPACE
Source in. Clarity out.
Build time, byte sizes and compatibility.
Not a made-up security score.
SOURCE untitled.lua
PROTECTED OUTPUT
Ready. Uploaded files stay in this browser. Building does not execute your script.
Build time—compiler wall time
Output size—UTF-8 bytes
ValidationNot builtCLI adds reference compilation
Execution runtimeNot measuredyour script is never run here
Inspect the build report JSON ↓
Build a script to see applied transformations and limitations.
Use --!luwave VM name or ENC_FUNC name for selected functions in the checked subset on either target. VM builds skip the source loader. High works without dynamic loading. Extra reconstructs a source chunk and requires load; it is not a VM and is unavailable in standard Luau. Structural validation is not a complete parser.
ENGINEERING, NOT MAGIC
Layers with honest limits.
Catch broken payloads.
Extra validates payload format and a checksum before loading. Three equivalent decoder layouts add variety. The selective function VM separately varies actual instruction handlers. All checksums are bypassable, not authenticated tamper-proofing.
Implemented · Lua 5.4Choose the real target.
Explicit Lua 5.4 / Luau targets, size limits, diagnostics and CLI reference checks. VM / ENC_FUNC directives compile checked functions to bytecode, including passed callbacks, table lookup/write and methods. Lexical globals/upvalues, nested closures, varargs and checked for loops are supported; unsupported syntax fails clearly. JIT, JIT_MAX and INLINE are not implemented.
Partial Luau supportKeep secrets server-side.
No client-side obfuscator can guarantee memory secrecy. Decoded strings, code and keys can be observed. No hostile-environment detection or destructive runtime behavior is bundled.
Design boundaryMEASURE WHAT MATTERS
Check it.
Don’t just trust it.
Our CLI compiles source and output with a reference compiler without executing either. Trusted-fixture benchmarks record runtime, size and recovery results separately. A successful compile is not proof of behavioral equivalence.
The source repository includes regression tests and measured release evidence. No universal hardness score or “undumpable” claim.
LUWAVE CLI LOCAL / REPRODUCIBLE
# Lua 5.4 · check input and output node cli/luwave.cjs main.lua \ --dialect lua54 --profile extra \ --seed 42 --check \ --output main.protected.lua \ --report build.json # Luau · no dynamic loader node cli/luwave.cjs main.luau \ --dialect luau --profile high \ --check --compiler luau-compile