10

⚙ AES-256 HTML OBFUSCATOR

Military-grade encryption · Anti-debug traps · Multi-layer obfuscation

ORIGINAL HTML CONTENT SECRET PASSWORD (minimum 32 characters recommended)

Enter a password to check strength

Ready. Paste your HTML and set a strong password.

<waiting for result...>

🔒 HOW THE PROTECTION WORKS

1. AES-256-CTR Encryption

Your HTML is encrypted using AES-256 in CTR (Counter) mode via the browser's native SubtleCrypto API — the same standard used by governments and financial institutions. CTR mode converts AES into a stream cipher, making it highly resistant to frequency analysis and padding oracle attacks.

2. SHA-256 Key Derivation

Your password is hashed via SHA-256 before being used as an encryption key. This means even short passwords produce a full 256-bit key. The raw password is never stored or transmitted anywhere.

3. Random IV Per Encryption

A unique 128-bit Initialization Vector (IV) is generated for each encryption via crypto.getRandomValues(). This guarantees that the same HTML encrypted twice with the same password produces completely different ciphertext.

4. Key Splitting with Indexed Reconstruction

The password is split into 3 segments. Each segment is stored separately in the generated code with a randomly shuffled order — but the original indices are preserved so reconstruction is deterministic. This prevents static analysis from easily identifying and reassembling the key.

5. Anti-Debug & Anti-DevTools Traps

• Timing trap: performance.now() detects debugger pauses longer than 100ms and wipes the page
• Console override: All console.* methods are replaced with no-ops to block logging
• toString detection: Checks if native functions have been hooked or modified
• Recursive debugger traps hidden inside dead code paths

6. Multi-Layer Code Obfuscation

• All variable and function names are replaced with random hex strings
• Strings are split into character code arrays and reassembled at runtime
• Dead code blocks and fake functions are injected throughout
• Fake comments disguised as real logic
• The decryption function is wrapped in a self-executing closure with randomized parameter names

7. Honest Limitations

• This protects against casual inspection and automated scrapers
• A skilled reverse engineer with enough time can always break client-side obfuscation
• Security depends entirely on keeping the password secret
• Not a substitute for server-side access control for truly sensitive content