✳ A CLEANER LUA WORKFLOW

Your Lua.
Refined. Packed. Ready.

A focused Lua protection workspace with conservative token-based transformation, per-build payload packing, and a runtime integrity guard. Client-side code can still be captured at runtime.

✓ Local-first processing ✓ Per-build payloads ✓ Verified packing

THE WORKSPACE

Process a Lua script

Upload a .lua file to transform and pack it. The browser fallback keeps the source on this device; private server processing is used only when the health endpoint confirms it is available.

Starting LuaRN engines…

Source file

Choose the Lua source you want to protect.

01 / INPUT

Drop your .lua file here

ONLY .LUA FILESMAX 1 MB

Only .lua uploads are accepted. When local mode is active, Lua source stays on this device and is not uploaded.

Runtime integrity guard — always on (v1.8.1)As of v1.8.1 this is mandatory for every build, website, embed, SDK, and API alike, and can no longer be turned off. It adds runtime-library behavior checks and quadruple payload/manifest-integrity checks before your script runs. It avoids executor fingerprinting and crash loops; it cannot prevent runtime inspection or stop a determined attacker from patching the loader. ON

Every build uses compressed byte-escaped payloads split into shuffled per-build slices, independent per-slice and whole-stream reversible byte transforms, randomized private loader names, three per-slice rolling integrity checks, and separate reconstructed-payload/source checks. Comments and formatting are removed, every string literal is individually encrypted with its own per-build key and decrypted inline at the point it is used, and eligible local bindings are renamed through lexical scope resolution. Numeric literals can optionally be encrypted the same way; this is off by default because tight arithmetic loops are far more sensitive to the added per-access cost than typical string usage is. Globals, closure captures, loop variables, and table member/key names are handled conservatively; reflective and typed syntax may intentionally retain names. These raise the effort needed for static inspection; the loader still reconstructs transformed Lua at runtime.

Integrity checks are intentionally non-invasive. They detect malformed runtime inputs, not all tampering or code inspection. Keep sensitive business logic on a trusted server instead of relying on client-side secrecy.

OUTPUT FORMAT Single-line outputWhen enabled, the comment stays on line 1 and the compact payload starts on line 2 with exactly one leading space. The payload itself has no internal line breaks. Current setting: two lines — protection comment on line 1 and protected payload on line 2. This affects the next build.

Upload a Lua file. If server processing is unavailable, LuaRN can process it locally in your browser.

Output preview

Your output uses LuaRN’s packed-loader format, per-build payload transformation, integrity checks, and conservative local-name obfuscation. Runtime integrity checks are optional. No client-side output is guaranteed undumpable.

02 / OUTPUT

No output generated yet

Upload a .lua file for obfuscation and preview the downloadable result. Browser processing remains available if server processing is unavailable.

OUTPUT CANVAS

Always test generated files in a safe environment before use.

Starting LuaRN engines

LuaRN uses private server processing only when the health endpoint confirms it is available. Otherwise, the browser fallback runs on this device. Test output in the actual target runtime.

Upload

Select a .lua file; browser fallback keeps source local.

Transform & pack

Resolve eligible local bindings, normalize safe literals, and package the payload.

Export

Preview, copy, or download the .lua result.

DEVELOPER ACCESS

LuaRN API & SDK

Integrate LuaRN into an HTTPS website when the API service is active. Self-service keys, quotas, and origin checks are provided by the protected Worker configuration.

API v1.8.1

1. Create your own API key

When the API service is active, you can create a key for your HTTPS website without an administrator token. The portal gives you a public API key, a private key-management token, and a ready-to-paste official embed snippet. Your management token controls only your own key.

Get an API key ↗

When self-service API management is online, customers can manage their quota or revoke their own key. The private ADMIN_TOKEN remains reserved for site administration and analytics.

2. Add the LuaRN SDK

Load the hosted SDK, then use your key that was registered for the exact HTTPS origin of the current website.

<div id="luarn-api-widget"></div>
<script src="https://luarn.pages.dev/api-sdk.js?v=172" defer data-luarn-widget data-luarn-brand="LuaRN Obfuscator" data-luarn-target="#luarn-api-widget" data-luarn-api-key="lrn_pub_YOUR_KEY"></script>

Server-side processing (when enabled)

const result = await LuaRNAPI.obfuscateRemote(luaSource, {
  apiKey: "lrn_pub_YOUR_KEY",
  filename: "script.lua",
  includeAntiTamper: true
});
LuaRNAPI.download(result);

When server processing is enabled, Lua source is sent to LuaRN over HTTPS and processed by the configured Worker. Local browser fallback keeps source on the device but must reconstruct code to execute it. Verify /v1/health before relying on remote processing. Create a separate origin-bound key for each website.

3. API reference

Endpoints and operating model.

LuaRNAPI.obfuscateRemote(source, options)Sends Lua over HTTPS to the Worker when the server engine is enabled. Requires a public API key registered for the website origin.

data-luarn-widgetdata-luarn-api-keyCreates a copy-paste widget automatically; no inline JavaScript is required.

GET /v1/healthPOST /v1/authorizePublic health endpoint and origin-bound authorization. Public keys are not admin secrets.

POST /v1/keysGET/PATCH/DELETE /v1/keysSelf-service key creation and owner-token management. Global analytics remain admin-only.

dailyLimit / expiresAtEach key can have its own daily quota and optional expiration. Expired keys are denied and automatically revoked by the scheduled cleanup.

Traffic analytics are retained for 30 days and store request metadata, not Lua source or raw IP addresses. Public keys are visible in website code by design; they are restricted by origin and quota, not treated as secret credentials. Non-browser clients can forge Origin headers, so quotas and server-side monitoring still matter. The current direct-upload package bundles the server engine in the Pages Worker. If the API is unavailable, open /v1/health and check engineInitialized, serverProcessingEnabled, and databaseReachable. Python bots can create private lrn_srv_ keys from the public /api-keys.html portal without an admin token; see /API-QUICKSTART.md. Keep bot keys in server-side secrets, never in browser HTML.

Get an API key ↗Open API example ↗Check API health ↗

Your Lua.Refined. Packed. Ready.