Protection that is actually running
Every method on this page ships in production on luawarden.pages.dev today. If it is not listed here, we have not built it, and we will not claim it.
Real obfuscation
A bytecode-level engine (the Darkfuscator VM) compiles your source to a protected IR and executes it through a custom virtual machine. No fake "string scrambles": output is genuinely not your source.
Whitelist keys
Cryptographically random keys with expiry, HWID resets, IP locking, suspension and per-key notes. One-time codes and bulk generation.
HWID binding
A key binds to the first executor HWID that activates it. Sharing a key means sharing the bind. Admins can reset it per key.
Kill switch
Every script has a master switch. Flip it and every loader refuses to hand out the payload within seconds, without redeploying anything.
FFA and keyed modes
Free-for-all loading for public releases, or key-gated loading with per-key HWID checks enforced server-side before the payload moves.
Two-stage loader
The public loader URL hands over only a bootstrap. Source is fetched from a second, authenticated endpoint, so raw-pasting the loader URL never reveals your script.
Load logs
Every loader attempt is logged with masked key, masked HWID, IP and result. Export to CSV. Credentials are never returned whole by the API.
Rate limiting
Registration, sign-in, migration and password endpoints are rate-limited per IP and per account, with timing-safe failure paths.
What the obfuscator does
The engine converts your Luau source into an intermediate representation, encrypts constants, splits integers, and emits a custom VM with integrity self-checks. Presets trade build time and runtime for strength:
| Preset | VM layers | Junk steps | Best for |
|---|---|---|---|
| Light | 1 | 1 | Quick iterations, small scripts |
| Balanced | 1 | 2 | Default. Strong protection, smooth runtime |
| Maximum | 1 | 3 | Most sensitive logic; slower build and run |
Stacked VM layers multiply runtime roughly 300× per layer, so builds use one layer by design. Builds run synchronously in-request with a 400 KB source cap; that is the documented trade of the free tier.
Not (yet) on the list
Being straight with you: there is no email password recovery (the free tier has no mail provider), no obfuscation beyond the listed methods, and no promise of being "impossible" to reverse. Obfuscation raises the cost of stealing your source. It does not make it impossible.