A simple API.
Serious protection.
Protect your Luau scripts with a single request. Free to use, no API key required.
https://syntexy.pages.dev/api/v1/obfuscateSend a JSON object with your source code. Syntexy validates your request, processes the script, and returns protected code with the Syntexy watermark. The alias /api/obfuscate is also supported.
01. Make your first request
const response = await fetch("https://syntexy.pages.dev/api/v1/obfuscate", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
code: 'print("Hello, Syntexy!")',
preset: "recommended"
})
});
const result = await response.json();
if (!response.ok || !result.success) {
throw new Error(result.error);
}
console.log(result.code);The minimal request is simply { "code": "print('Hello')" }. Recommended protection is applied by default. You can also use preset: "fast" for AST-only protection, "maximum" for five VM layers, or "luavm" as an alias of recommended.
02. Fine-tune every layer
Pass an options object to override your selected preset. All boolean options default to true; VM depth defaults to 3.
| Option | Type | What it does |
|---|---|---|
useFalconEngine | boolean | Proprietary multi-layered Luau VM virtualization & anti-analysis. |
useLuaVM | boolean | Virtualize your code into custom bytecode. |
encryptStrings | boolean | Keep sensitive string literals unreadable. |
proxifyLocals | boolean | Wrap local variables in proxy containers. |
proxifyFunctions | boolean | Protect function declarations with proxies. |
antiTamper | boolean | Add runtime integrity checks. |
controlFlowFlattening | boolean | Make execution paths harder to follow. |
isLuauRuntime | boolean | Enable Luau-specific protection passes. |
minify | boolean | Remove comments and shorten identifiers. |
loaderVMDepth | integer | Nested VM layers, from 1 to 5. Only used with LuaVM. |
{
"code": "print('Protected')",
"options": {
"useLuaVM": true,
"loaderVMDepth": 3,
"encryptStrings": true,
"antiTamper": true,
"isLuauRuntime": true
}
}03. Handle the response
A successful request returns success: true, the protected code, output statistics, and a completion log. Example statistics below are illustrative.
{
"success": true,
"code": "--[( Protected by syntexy.pages.dev )]--\n...",
"stats": {
"input_bytes": 18,
"output_bytes": 16420,
"input_lines": 1,
"output_lines": 2,
"elapsed_seconds": 0.38
},
"logs": [
{
"level": "success",
"time": "16:20:01",
"message": "Protection complete. Your script is ready to download."
}
]
}Syntax errors return HTTP 200 with success: false, an error string and, when available, error_details containing line, column, detail, suggestion, and snippet. Always check both the HTTP status and success.
| Status | Meaning |
|---|---|
| 400 | Invalid JSON, empty/oversized code, unknown preset, or invalid options. |
| 413 / 415 | Request body too large / unsupported content type. |
| 429 | Rate limit exceeded. Respect the Retry-After header. |
| 502 / 503 / 504 | Processing service error, temporary unavailability, or timeout. |
04. A few things to know
- Maximum source size: 200 KiB (204,800 UTF-8 bytes). JSON body limit: 1,250,000 bytes.
- Up to 10 valid requests per IP address per minute, shared between the website and API. Limits reset at minute boundaries.
- Processing has a 60-second timeout. Retry transient failures with exponential backoff.
- Requests are forwarded to an external processing service. Do not submit credentials or code you are not authorized to share.
- Obfuscation raises the cost of reverse engineering; it does not guarantee secrecy. Keep server-only secrets on the server.
- Always test protected scripts in Roblox Studio. VM layers and anti-tamper checks can affect compatibility and performance.
- Syntexy does not save your source or output. Download your result before leaving the page.