Protect the WebAssembly you ship to the browser.
TrustSig Protect obfuscates what you ship and virtualizes the logic, so nothing readable reaches the browser.
checkLicensef_7b2edecryptPayloadf_04c9verifyTokenf_e1a6loadEntitlementsf_9d3f
app.wasmSaved and read by anyone
Your module is one download away.
WebAssembly reaches the browser as a file like any other.
Anyone can save your module and open it in tools that cost nothing.
Function names, imports and strings spell out what each part of it does.
From there, changing what your app decides is a question of patience, not skill.
Nothing is named, and nothing runs in order.
The names go, and the path through your code stops making sense.
Every meaningful function, import and export name is stripped or randomised.
Control flow is flattened, so the order your code runs in is no longer visible in the file.
Fake decision points sit next to the real ones and survive the clean-up passes tools run.
Instructions only our engine runs
The parts that matter stop being WebAssembly at all.
Obfuscation hides how your code reads. Virtualization changes what it is.
You mark the functions worth hiding. With the Rust toolchain that is a single annotation.
Protect compiles them into bytecode for an instruction set that exists only in your build.
A small engine ships with your app and runs that bytecode, so the original function never lands in the file.
Reading your module stops being the easy part.
Before, an afternoon with free tools was enough to see how your app decides things. After, there are no names to search, no order to follow, and the parts that matter are not WebAssembly any more.
A different instruction set every time
There is no engine to learn once.
Understanding one build teaches nothing about the next.
The instruction set is generated per build, so bytecode from one release is meaningless in the release after it.
Two engines run your logic, one for WebAssembly and one for JavaScript, and every call between them is encrypted.
Before reading a single instruction, a reverser has to work out the engine first, and then do it again when you ship.
- Public decompilerNo match
- De-obfuscatorNo match
- Symbol recoveryNo match
Nothing to unwrap
No off-the-shelf tool recognises the output.
Public de-obfuscators look for patterns our engine never leaves.
The obfuscation engine is ours, not a wrapper around a public one.
Off-the-shelf de-obfuscators have nothing to unwrap, because the output matches nothing they know.
Every build is laid out differently, so anything learned from one file is worthless against the next.
What a protected build carries.
- Virtualization
- The functions you pick run as bytecode on an engine that only your build has.
- Control-flow flattening
- The order your code runs in stops being visible in the file.
- Symbol scrubbing
- Function, import and export names are stripped or randomised.
- Polymorphic builds
- Every build differs byte for byte, down to the layout of the bytecode.
- String vault
- Sensitive values stay encrypted and are decrypted only for the instant they are used.
- Anti-debugging
- Breakpoints and single-stepping are detected while your app runs.
- Anti-tampering
- Patched code, hooked browser functions and swapped runtimes are caught.
- Honeytokens
- Bait values no real user touches mark whoever uses them as an attacker.
WebAssembly protection, answered
Obfuscation makes your code hard to read while it stays WebAssembly. Virtualization replaces it with bytecode for an instruction set that only your build understands, so there is no WebAssembly left to read.
Yes. Protect ships an engine for each, so the JavaScript you choose gets the same treatment as your WebAssembly.
Only the functions you choose run inside the engine, and virtualization lands on those alone, so the rest of your bundle runs as it always did.
Given enough time and skill, anything running on a visitor's machine can be taken apart. None of that work carries over, because your next build is laid out differently.
Get in touch.
Tell us what your module does, what needs protecting, or whatever you want to ask.