You can write your topic however you want, but you need to answer these questions:
What do you want to achieve? Keep it simple and clear!
→ I want to hide my local scripts content from exploiters so that they can’t steal my code.
What is the issue? Include screenshots / videos if possible!
→ I’m unsure how.
What solutions have you tried so far? Did you look for solutions on the Creator Hub?
→ I’ve thought about using some type of API like loadstring() or some HTTP call to my github, but I’m not sure how that works. Other solutions on the Forum says that I can’t, but they’re old and I want to make sure.
If you know what bytecode compiler is you are just asking to shoot yourself in the foot and enjoy it.
Don’t do that, learn what bytecode is before even attempting such a thing, nothing is ever trully obfuscated and when is you only hurt innocent people.
Exploiter have access to compiled bytecode only so all your skidding with renaming variables do no affect to exploiter since their Luau code is reverse compiled anyway.
You can’t hide or protect any LocalScript. If the client runs it, an exploiter can read it. The only real solution is to move all important logic to the server and keep the client limited to input, UI, and visuals. This is a universal rule in software: once code is on the client, it belongs to the client. Obfuscation only slows people down, it never prevents access. Real protection comes from keeping anything sensitive on the server.
That the opposite as to what you want to do.
Hitting network overhead instead of letting client simulate visuals is stupid, its only roblox where you can find this absurd.
Oh ok fair
Do you know any games that use it though? That weird networking behavior is roblox specific usually since other game engines force you to manually send packages.
Obfuscating Local Scripts is not how you would want to do things; in-fact even implementing any form of obfuscation is a big red advertisement for the very folks you’re trying to protect it from to go ahead and crack it so they can get their accomplishment from it, and they will absolutely use it to rub it in your face.
Ultimately the logic has to be preserved for the code to execute as expected, no matter how many jigsaw puzzle pieces it takes to put it back together.
It would be more productive for you to acknowledge that anything you replicate to the client is no longer yours to control the same way that you can for server code or anything that ISN’T replicated to the client.
I’m speaking from experience. Don’t waste the same amount of time I did.
Own no code and be happy
Glory to the new luau order
Building entire rojo → obfuscator → Studio pipeline?
That just a distaster waiting to happen
Simply forget about freedom and focus on optimizing the code.
Roblox is actually better than most. Most games from engines like Unity or Unreal are hacked to death within hours of release. At least you have somewhat of a firewall here. It is a hassle to constantly use remotes, but considering the alternatives, it is far better.
Nothing like working on a game for a decade only to see it turned into a repack instantly.
Beyond remotes, the server can control specific values, like a player’s health, score, currency, and more. If the server says this is it, that is it, clients can see the values, but they cannot modify them.
You can’t hide code. For anyone to be able to play your video game, their machine needs instructions. The rule of thumb is that If your game works, then that means your machine has the needed instructions. Sending an HTTP request is basically just downloading the code with extra steps.
As for obfuscation, yes, you can obscure functionality by making it unclear what the instructions do, but that will not stop anyone from using the code as is, in their game. Additionally, as a side effect, it makes debugging nearly impossible, severely degrades performance of your program, and makes development a lot more tedious without proper tools.
Roblox uses human readable strings for a lot of things, such as naming instances, attributes, tags, and collision groups. If you wanted to obscure them, you will have extremely difficult time navigating and scripting. To get around this problem, you would have to add a build step for production release, such tool would have to replace every human readable string in the game tree, and transpile code in scripts to replace identifiers and instance references with the random gibberish in a way that doesn’t cause unintended side effects, which I may add, would be very difficult given the dynamic nature of a scripting language like Luau.
I mean, as I said, you can use something like Rojo and put obfuscator between script updates in Studio, but obfuscation is a joke.
It’s made by people who are scared to take responsibility, so they choose to cope with this placebo technique.
I like to mislead rather than obfuscate. Make a slightly but not really hidden value like GodMode, GoldBoost, IsAdmin. One click and the game changes parts of itself. Here it would be a permanent ban from the game. Hackers just can’t resist trying them, and it only takes one time.
You mean anti-skid techniques?
Yeah, they are fine; just make bans randomly delayed instead of instant if possible. It makes exploiters freak out and not understand what specifically caused the ban.
as others have already said, this is just not worth it. Adding obfuscation is just adding bloat, and that’s if it even makes it past the compiler.
besides, if they only want the logic for the script, they can quite easily just take the decompiled (still obfuscated) code and stick it straight into their own script.
If you want client protection, you should keep a client anticheat alongside your server one. Don’t waste time obfuscating, it isnt worth it.
