✳ A CLEANER LUA WORKFLOW

Your Lua.
Ready to inspect.

A responsive Lua workspace with private server-side processing when available and a local browser fallback with optional Anti-Tamper checks.

✓ Lua-only uploads ✓ Downloadable output ✓ No account required

THE WORKSPACE

Process a Lua script

Upload a Lua file for obfuscation. Private server processing is used when available; local browser processing is the fallback.

Starting LuaRN engines…

Source file

Choose the Lua source you want to protect.

01 / INPUT

Drop your .lua file here

ONLY .LUA FILESMAX 1 MB

Only .lua uploads are accepted. When the private server is offline, the browser fallback keeps Lua source on this device and does not upload it.

Inject Anti-Tamper before obfuscationInject the rAT Anti-Tamper prelude before your Lua source, then pack both together. Roblox/Luau-specific; unsupported runtimes may stop execution. OFF

Automatic hardening is always enabled: each build gets a chained payload transform, integrity checks, comment/format removal, string-byte escaping, and conservative local-identifier renaming. This makes simple dumps less readable, but cannot stop a dumper that captures and analyzes code after runtime reconstruction.

Compatibility mode is the default. The bundled rAT Anti-Tamper module is highly runtime-specific and may deliberately halt on unsupported APIs. Enable only when you know your target runtime supports its checks.

Output format Both formats use LuaRN's own loader format and payload integrity check. Compact mode removes comments and collapses whitespace outside strings.

Upload a Lua file. If the private server is offline, LuaRN processes it locally in your browser.

Output preview

Your output uses LuaRN’s packed-loader format, per-build payload transformation, integrity checks, and conservative local-name obfuscation. Runtime Anti-Tamper is optional. No client-side output is guaranteed undumpable.

02 / OUTPUT

No output generated yet

Upload a .lua file for obfuscation and preview the downloadable result. Browser processing is available if the private server is offline.

OUTPUT CANVAS

Always test generated files in a safe environment before use.

Starting LuaRN engines

LuaRN uses the private server engine when available and falls back to local browser processing if it is offline. The fallback uses public site assets; test generated output carefully in your target runtime.

Upload

Select a .lua file; browser fallback keeps source local.

Pack

Compress the source and embed it in your loader.

Export

Preview, copy, or download the .lua result.

DEVELOPER ACCESS

LuaRN API & SDK

Integrate LuaRN into any HTTPS website with a self-service public key. No administrator token is needed to create or manage your own integration. The official branded widget is hosted by LuaRN and uses per-key quotas and origin checks.

API v1.4.0

1. Create your own API key

Anyone can create a key for their own HTTPS website without an administrator token. The portal gives you a public API key, a private key-management token, and a ready-to-paste official embed snippet. Your management token controls only your own key.

Get an API key ↗

Public customers can manage their own quota or revoke their own key. The private ADMIN_TOKEN remains reserved for LuaRN site administration and analytics.

2. Add the LuaRN SDK

Load the hosted SDK, then use your key that was registered for the exact HTTPS origin of the current website.

<div id="luarn-api-widget"></div>
<script src="https://luarn.pages.dev/api-sdk.js?v=140" defer data-luarn-widget data-luarn-brand="LuaRN Obfuscator" data-luarn-target="#luarn-api-widget" data-luarn-api-key="lrn_pub_YOUR_KEY"></script>

Server-side processing — engine stays private

const result = await LuaRNAPI.obfuscateRemote(luaSource, {
  apiKey: "lrn_pub_YOUR_KEY",
  filename: "script.lua",
  includeAntiTamper: true
});
LuaRNAPI.download(result);

Lua source is sent to LuaRN over HTTPS for in-memory processing. The server engine and templates are bundled privately and are not shipped to client websites. Create a separate origin-bound key for each website that uses LuaRN.

3. API reference

Endpoints and operating model.

LuaRNAPI.obfuscateRemote(source, options)Sends Lua over HTTPS to the private server engine. Requires a valid public API key registered for the website origin.

data-luarn-widget + data-luarn-api-keyCreates a copy-paste widget automatically; no inline JavaScript is required.

GET /v1/health · POST /v1/authorizePublic health endpoint and origin-bound authorization. Public keys are not admin secrets.

POST /v1/keys · GET/PATCH/DELETE /v1/keysSelf-service key creation and owner-token management. Global analytics remain admin-only.

dailyLimit / expiresAtEach key can have its own daily quota and optional expiration. Expired keys are denied and automatically revoked by the scheduled cleanup.

Traffic analytics are retained for 30 days and store request metadata, not Lua source or raw IP addresses. Public keys are visible in website code by design; they are restricted by origin and quota, not treated as secret credentials. Non-browser clients can forge Origin headers, so quotas and server-side monitoring still matter. The server engine and private templates are bundled into the Worker rather than served as assets.

Get an API key ↗Open API example ↗Check API health ↗

Your Lua.Ready to inspect.