I developed a web app with jQuery, HTML, and CSS markup which would be a premium web app. So I have to ensure the security of the code from being stolen. But, as all these are client side, there is no 100% secure way to protect them. But I want to make them harder to steal. For this I did:

  1. I disabled the right click menu
  2. I minified and obfuscated the code.
  3. I used Javascript code to add an external js file and obfuscated the code so that no one can understand the name of the external js file
  4. I created an index.html file in the js folder so that no one can access the js folder

Do you think all these are enough to make stealing harder? Or any suggestions or advice for me?

  • 2
    Consider: The people most likely to steal your code are other developers ... if you can defeat your security measures, they're not doing anything to protect your code.
    – danlefree
    Commented Aug 8, 2012 at 1:22
  • JavaScript is client side and stored in cache. So along with viewing the source of your site finding the file path names of the page which rendered and using chrome developer tool to view all the Scripts. It's pretty easy to get the code unminify it and then then un obfuscate the code. The time you're spending to protect your code could be spent on further developing your application. JavaScript can't be protected 100%
    – Anagio
    Commented Aug 8, 2012 at 11:31
  • If you disable right click, the will use left click and go to FILE and then SAVE AS, saving whole of your project
    – user2930
    Commented Mar 4, 2013 at 7:49

4 Answers 4


It's impossible to prevent your Javascript from being "stolen" because the code is served to the browser. To answer your specific points:

1. I have disabled the right click button of mouse

This will have absolutely no effect. No one will ever try to steal code using right click (heck, right click doesn't give access to anything in a browser anyway). So it won't prevent "casual thieves", let alone people who actually know what they're doing.

2. I have minified and obfuscated the code.

This is a decent step as it makes it much harder to understand exactly what the code it doing. However, there are are plenty of code "deminifiers" out there that will reformat the code nicely - albeit with unintelligible variable names.

3. I have used js code to add external js file and obfuscated the code so that none can understand the name of the external js file

If you load an external file at any time it is captured by browsers' developer tools (check the Network tab in Google Chrome). So this won't add any extra protection.

4. I have created a index.html file in the js folder so that none can get access the js folder

Again, this is worthless as anyone can see what JS file is loaded. Furthermore, "index.html" is a terrible way to prevent folder listing, it should be accomplished server-side (e.g. .htaccess file).

The real answer: you can't prevent Javascript theft at all. Minify and obfuscate to prevent any easy understanding of your code, but that's all you can do in terms of JS.

You may be able to move some of the logic to the server-side (and use AJAX in your app), which would of course prevent any users from using the JS without modification - they would need to replicate your server-side logic themselves.

And finally, don't forget that the Javascript code you write is already your property and copyrighted by you. If someone steals it they are breaking the law and you can seek legal action against them.

  • +1 The only way to protect JavaScript code is not to post it online at all. Make it available only when someone has paid for it. If you need to demonstrate to potential buyers how a commercial script works, do this with screenshots, explanations, and video walkthroughs. Alternatively, produce a free "light" version of the script with a greatly reduced featureset, then explain what benefits the paid (unpublished) upgrade will offer if they purchase that.
    – Nick
    Commented Sep 22, 2012 at 9:55

I have disabled the right click button of mouse

Don't do this.
There are valid uses for right-click that you are blocking in addition to (not) protecting your code. All you'll do is annoy everybody while doing absolutely nothing to stop the people who know enough to try and steal your code in the first place.

  • 2
    +1 for not being annoying. kilianvalkhof.com/2011/javascript/… Commented Aug 7, 2012 at 23:29
  • Indeed. In modern browsers I just press F12 (on Windows, something else on others) to bring up the developer tools and I have access to a hell of a lot more than right-click can get me. Commented Aug 8, 2012 at 11:15

Use PHP to make the JavaScript only load if the user is authenticated (by premium subscription?)

I have created a index.html file in the js folder so that none can get access the js folder

What if they guess the file name? You should be using a .htaccess for this to do a Options -Indexes to disable directory viewing; it's foolproof.

But most web applications I know of/write use some sort of hypertext processor like PHP or ASP. The source to the actual functionality is entirely closed if it runs on a secure server. Who cares if someone steals the CSS/JavaScript if when they copy the "source" they get a non-functional copy? You could also get it copyrighted or patented if it's unique and innovative.

  • A blank index.html file isn't such a bad idea. .htaccess files can become corrupt, which renders any Options -Indexes directives worthless.
    – Nick
    Commented Sep 22, 2012 at 9:38

Three options to "protect" your .js:

You can use a couple of different techniques for this but you have to understand that none of them represent fullproof protection. (They are only deterrents).

1) You can use an ajax script injection. This is deters theft because the same domain policy which prevents XSS will make the client side script difficult to run elsewhere.

2) You can obfuscate your code using any free online obfuscator.

3) You can use https://domainlockjs.com which creates very hard to trace errors in the console.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.