Commercial JavaScript Protection

SecureJS is designed for authors who need to distribute browser JavaScript without placing the private unlock key inside the deployed file. The protected script depends on a licensed, short-lived unlock response before it can execute.

Why It Matters

• No embedded author key: the generated script should not contain the private key or reconstructable key shares.
• Domain-licensed execution: unlock requests are checked against the authorised hostnames for the protected payload.
• Short-lived unlocks: runtime unlock responses are issued for a specific payload, host, nonce, and expiry window.
• Integrity checks: tampering with the encrypted package or unlock response prevents normal execution.
• Authorship watermarking: hidden metadata links the protected payload back to the author record.

Easier Deployment

• JavaScript blocks: protect a single pasted script for direct insertion into a page.
• Complete HTML pages: protect inline scripts while keeping the page structure intact.
• HTML Armour: make page markup harder to casually read, copy, and reuse with light source obfuscation and copy deterrents.
• Linked JS files: protect standalone .js files and load them through normal script tags.
• Upload or paste: upload source files or paste code directly into the editor before protection.
• Module-aware output: external imports stay readable so dependencies can resolve before protected code runs.

Best Fit

• Software authors distributing paid JavaScript tools or widgets.
• Agencies delivering client-side functionality that should not be copied between projects.
• SaaS vendors exposing valuable browser logic while retaining licence control.
• Product teams that need ownership evidence through embedded watermarking.

Security Position

SecureJS does not claim that browser JavaScript can be made impossible to inspect after it has been authorised and run. The stronger claim is narrower and more realistic: a copied protected file should not be reversible from static source alone when the author key is private and the unlock server is correctly configured.

HTML Armour is a lighter protection layer for markup. It is intended to discourage casual copying and reuse, not to act as server-side access control or an unbreakable document lock.

Operational Requirements

• The author must keep the private key secret.
• The hosted unlock endpoint must remain online for protected scripts to start.
• Payload records and server secrets must be backed up and protected.
• High-value deployments should use monitoring, failover, and key rotation procedures.

Simple Deployment

1. Protect the JavaScript in the SecureJS console.
2. Authorise the production domain.
3. Deploy the generated script to that domain.
4. Keep the author key and payload store private.