Encrypt Api (Free)

[sanjay2003 (Sanjay)]

There’s some weird notion that obfuscation will somehow protect your files from being stolen. This is completely false. Exploiters can see all things client & even the least experienced exploiters use tools designed by seasoned ones. Having a key won’t do anything for you.

@MMCraftin

THIS IS NOT MEANT TO REPLACE SERVER SIDED CHECKING THIS IS JUST MAKING IT A LOT HARDER FOR EXPLOITS TO BE MADE. ALWAYS SECURE THE SERVER.

This isn’t correct at all. The server is already “secure” because code access to it is restricted & away from the client’s view. You should be using sanity checks on the server by default so, I’m not entirely sure what this actually entails.

@MMCraftin

Many exploits are run by manipulating remote events. This is commonly fixed by server side checks but exploiter using remote event spying can always see the data being sent between the client and the server.

I have no idea what “remote event spying” is. I don’t actually know if this is a real or made up term. Part of me wants to know & the other part is like: Sanity checks. Sanity checks. Sanity checks.

@MMCraftin

This api is meant to be used to encrypt the data before it is sent so to exploiters its just a bunch of jibberish.

The irony in this statement. Nice.

@MMCraftin

On the local side you will need to make a script and put the module inside due to that you can’t require on the client. I recommend naming it random letters and character to make it so exploiters won’t know what is is.

Exploiters can access local scripts through pre-compiled byte code & then, decompile it into something readable. Every check you put on the client can be bypassed. Random naming schemes in the grand scheme of things doesn’t amount to anything. It’s more of a mental false sense of security. If they’re exploiting, they know what it is. Not themselves but, the code of which was copied from a site knows what your game is & where to exploit it.

@MMCraftin

-- Call The API
local api = require(script["YWR1aXdhZHVod25kcw=="])
-- Set Your Key
local key = 1023921391233933
-- Encode Text
print(api.encode(key,"test"))
-- Cannot Decode On Client For Security Reasons

--Encrypted Remote

game.ReplicatedStorage.RemoteEvent:FireServer(api.encode(key,"hello"))

From what I can tell, you’re storing the key on the client & encrypting it based on the key provided. This is probably the worst thing you could do. No, no. It’s definitely the worst. Apart from leaking your code willingly.

@MMCraftin

The key is a 16 digit number which is used to encrypt all your data. As you can see in the code the word hello is being encrypted. When the string is sent accross the client server barrier it can only be seen as “b0cd990bfd”.

What.

@MMCraftin

-- Call The API
local api = require(5574188332)
-- Set Your Key
local key = 1023921391233933

--Encode Text
print(api.encode(key, "test"))

--Decode Text
print(api.decode(key, "84cd84f3"))

--Encrypted Remote

game.ReplicatedStorage.RemoteEvent.OnServerEvent:Connect(function(plr, text)
	print(api.decode(key, text))
end)

There’s another key. I’m kinda confused. This is like a locked door that’s meant to be locked but, everyone has the code to the door so now, it’s just a door. An empty & generic door.

@MMCraftin

As you can see the remote is decrypting the jibberish back into the word “hello”.

More irony.

@MMCraftin

Your 16 digit key is what protects all your strings if that is leaked or somehow found all remotes will no longer be secured. I recommend obsfucated your local scripts to keep it secure. A good obsfucator can be found here: https://obfuscator.aztupscripts.xyz/Home

Within the api there is no way to run decode on the client due to the fact that a good enough exploiter could call the local module themselves and decode the text before it is sent.

That site looks incredibly sus. I’m surprised that it’s allowed to be posted here.

@MMCraftin

Documentation:

module.encode(key, string) - encodes the string
module.decode(key, string) - decodes the string

This isn’t documentation. I’m not sure what this is classified as. Documentation has a specific style & universal context. There’s no return, parameter types or in-depth detail on what this does besides three words that are all lowercase.

I felt like I did a cinema sins video on a movie. I strongly do not advise using this in production code or games. Stick with server-based sanity checks. We need to get rid of posts like these. They’re misleading & promote horrid habits.

Edit: The actual module is obfuscated & is placed in community resources…? Why would you obfuscate your code & publish it as a “public resource”?