Free Luau protection, no key needed

Your scripts, sealed inside a haunted VM

Cyrway compiles Luau into its own bytecode format and ships it with a per-build interpreter. Opcodes reshuffle every build, strings stay encrypted, and tamper checks run the whole time. Everything is free and runs entirely in your browser.

Start obfuscating Read the docs
cyrway, sample build
-- Protected by Cyrway. return ({"CHr"]="Wz5UGYHwkDNeuexkZfJ0A-4jqjXd__6Oo53ahtQTHl8G0_Cj_QqxVCvWi0IzwexZ5TYDkRzhkp6Czp_164w--tr3JP6pNIYzYugb4bbpCrANceiZDVlUdIqPgZhh0fY4TMXjDwqRVHnxYliQFLA-JSwmoPQkBKPCr1Q4-oYzZFECAxHx0f6BzKYAhpiWSXNK7O3b7f", ["Hqr"]=41446,["JAV"]=33616,["Tsr"]=11289})
real protected output, truncated. the original source does not survive the build.

Four protection levels

Same engine, escalating depth. Every level is free, with no build limits.

01Light

Single VM, no junk, no integrity overhead. Fastest runtime and smallest output for scripts that just need the source gone.

02Balanced

Source-level IR pass, payload compression and fast integrity checks. The everyday default for live scripts.

03Maximum

Secure VM layout, heavy junk injection, full integrity verification and scrambled constants.

04Paranoid

Maximum plus a second stacked VM, independently keyed. Strongest protection, much larger output and slower runtime.

Inside a build

Every build walks the full pipeline. Nothing is a rename-and-ship pass.

ParseA Luau lexer and parser turn your source into an AST with full scope tracking.
AnalyzeSemantic analysis and a source-level IR pass reshape the program before compilation.
CompileThe compiler emits register bytecode for a custom instruction set: one proto per function, constants pooled.
EncodeOperands are zigzag-masked with per-proto positional keys, constants scrambled, strings pooled behind a lazy decode layer.
SealChunked checksums over the instruction stream ship inside the encrypted payload and are re-verified as execution crosses chunk boundaries.
Generate the VMA fresh interpreter is emitted per build: randomized dispatch shape, handler variants, opaque predicates and decoy paths.
WatermarkA build ID rides inside the encrypted payload, so a leaked build traces back to the run that produced it.
VerifyThe engine re-parses the output with the real Luau parser and refuses to return anything invalid.

FAQ

Is it really free?

Yes. No keys, accounts, credits or limits. Open the dashboard and build; the CLI is free too.

Does my source get uploaded anywhere?

No. Obfuscation runs in your browser. Your source never leaves your machine; closing the tab clears it.

Can two builds of the same script collide?

No. The seed drives identifiers, opcode numbering, constant layout, VM structure and junk, so two builds share nothing. Same seed gives an identical build.

Will it change what my script does?

The engine is parity-tested: 243 corpus cases plus 126 IR cases run protected builds and originals in a real Luau interpreter and require identical output.

Is it impossible to deobfuscate?

No honest obfuscator claims that. Cyrway raises the cost of reverse engineering substantially; it does not make it impossible.

Does it detect or attack exploits?

No. Cyrway protects the script; it does not fingerprint or attack the user's environment.