Docs

1. Create an account and open the dashboard.
2. Pick your language, target (e.g. FiveM or Roblox) and a preset (start with vm).
3. Paste code or upload a file, then Obfuscate and download. The first line of the output is always the -- CodeMask header.

Prefer the terminal? Use the CLI:

codemask obfuscate script.lua --preset vm --target fivem -o out.lua

Language is auto-detected from the file extension:

Lua targets drive the dialect + emitted runtime:

Presets bundle the VM tier and classic passes. vm and vm-low virtualize; the rest are non-VM transforms of increasing strength.

When a VM preset is active, these knobs control how hard the VM is to reverse:

CodeMask macros are ordinary function calls in your source, prefixed CM_. They are resolved at compile time — no macro names survive in the output. Use them to steer the obfuscator per-region. (The legacy IZP_ prefix is still accepted as an alias.)

-- kept as plain, fast Lua:
local tick = CM_NO_VIRTUALIZE(function()
  return GetGameTimer()
end)

print(CM_ENCSTR("license-key-9F2A"))

local port = CM_ENCNUM(31337)

local check = CM_ENCFUNC(function() return verify() end)

local hot = CM_JIT(function(n) return n * n end)

local f = CM_NO_UPVALUES(function() return 1 end)

if tampered then CM_CRASH() end

Every account has a personal API key (prefix cm_). Find it on your dashboard under API Access — reveal, copy, or reset it there. Resetting invalidates the old key immediately, so update any scripts that use it.

REST endpoint. POST JSON to /api/v1/obfuscate with your key in the Authorization header. The response is { code, filename, stats }.

curl https://codemask.io/api/v1/obfuscate \
  -H "Authorization: Bearer cm_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "print(\"hello\")",
    "filename": "script.lua",
    "preset": "vm",
    "target": "fivem"
  }'

Max input is 2 MB. A missing or wrong key returns 401.

The codemask command is a thin client for the API — the engine runs on codemask.io, so it needs your API key. Authenticate once, then obfuscate a single file or a whole FiveM resource directory.

# authenticate once (saves to ~/.codemask/config.json)
codemask login cm_your_key
codemask whoami          # verify the account

# or per-command: --api-key cm_...  |  CODEMASK_API_KEY env

codemask obfuscate <file> [-o out] [--preset <p>] [--target <t>] [--lang <l>] [--nest <n>] [--compress]
codemask resource  <dir>  [-o outdir] [--preset <p>] [--target <t>] [--nest <n>] [--compress]

Examples:

# FiveM script, full VM
codemask obfuscate client.lua --preset vm --target fivem -o client.obf.lua

# Roblox module (no compression — loadstring is sandboxed)
codemask obfuscate module.lua --preset vm --target roblox

# TypeScript, strongest non-VM
codemask obfuscate app.ts --preset high

# Whole FiveM resource (manifests copied, .lua files obfuscated)
codemask resource ./my-resource --preset vm -o ./my-resource-obf

FiveM (CfxLua): select fivem. Backtick hash literals, ?./?[] safe navigation and vector literals are supported; event names, exports and fxmanifest.lua are preserved. Compression and the debug library work.

Roblox / Luau: select roblox. The VM emits bit32-based bitwise ops, avoids goto/integers, and VM Compression is forced off because Roblox sandboxes loadstring. Constant encryption and integrity checks are made bitwise-free so they run on Luau.

• The line map remaps uncaught errors only. Messages from pcall-caught errors still carry the obfuscated line — enable Disable Line Info if that matters.
• VM Compression needs load(), so it stays off for Roblox.
• The JavaScript bytecode VM covers a documented subset; out-of-subset code transparently falls back to the classic JS pipeline — it never breaks your code.
• VM nesting and higher optimization trade output size + runtime for strength — tune per script.