LuaRNLUA OBFUSCATOR
CHECKING ENGINE
v1.6.8
✳ A CLEANER LUA WORKFLOW

Your Lua.
Refined. Packed. Ready.

A focused Lua protection workspace with conservative token-based transformation, per-build payload packing, and a runtime integrity guard. Client-side code can still be captured at runtime.

✓ Local-first processing ✓ Per-build payloads ✓ Verified packing

THE WORKSPACE

Process a Lua script

Upload a .lua file to transform and pack it. The browser fallback keeps the source on this device; private server processing is used only when the health endpoint confirms it is available.

Starting LuaRN engines…

Source file

Choose the Lua source you want to protect.

01 / INPUT
Drop your .lua file here

or

ONLY .LUA FILESMAX 1 MB
i

Only .lua uploads are accepted. When local mode is active, Lua source stays on this device and is not uploaded.

Every build uses compressed byte-escaped payloads split into shuffled per-build slices, randomized reversible arithmetic byte transforms, randomized private loader names, and three independent rolling integrity tripwires. Comments/formatting are removed, strings are escaped, and eligible local identifiers are renamed conservatively. These raise the effort needed for static inspection; the loader still reconstructs transformed Lua at runtime.

Integrity checks are intentionally non-invasive. They detect malformed runtime inputs, not all tampering or code inspection. Keep sensitive business logic on a trusted server instead of relying on client-side secrecy.

Both formats use LuaRN's shuffled-slice loader and integrity checks. Output starts with the requested LuaRN banner, followed by a per-build generation tag; compact mode keeps the packed loader body on one physical line.

Upload a Lua file. If server processing is unavailable, LuaRN can process it locally in your browser.

Output preview

Your output uses LuaRN’s packed-loader format, per-build payload transformation, integrity checks, and conservative local-name obfuscation. Runtime integrity checks are optional. No client-side output is guaranteed undumpable.

02 / OUTPUT
No output generated yet

Upload a .lua file for obfuscation and preview the downloadable result. Browser processing remains available if server processing is unavailable.

OUTPUT CANVAS

Always test generated files in a safe environment before use.

Starting LuaRN engines

LuaRN uses private server processing only when the health endpoint confirms it is available. Otherwise, the browser fallback runs on this device. Test output in the actual target runtime.

01
Upload

Select a .lua file; browser fallback keeps source local.

02
Transform & pack

Remove noise, rename eligible locals, and package the payload.

03
Export

Preview, copy, or download the .lua result.

DEVELOPER ACCESS

LuaRN API & SDK

Integrate LuaRN into an HTTPS website when the API service is active. Self-service keys, quotas, and origin checks are provided by the protected Worker configuration.

API v1.6.8

1. Create your own API key

When the API service is active, you can create a key for your HTTPS website without an administrator token. The portal gives you a public API key, a private key-management token, and a ready-to-paste official embed snippet. Your management token controls only your own key.

Get an API key ↗

When self-service API management is online, customers can manage their quota or revoke their own key. The private ADMIN_TOKEN remains reserved for site administration and analytics.

2. Add the LuaRN SDK

Load the hosted SDK, then use your key that was registered for the exact HTTPS origin of the current website.

<div id="luarn-api-widget"></div>
<script src="https://luarn.pages.dev/api-sdk.js?v=166" defer data-luarn-widget data-luarn-brand="LuaRN Obfuscator" data-luarn-target="#luarn-api-widget" data-luarn-api-key="lrn_pub_YOUR_KEY"></script>

Server-side processing (when enabled)

const result = await LuaRNAPI.obfuscateRemote(luaSource, {
  apiKey: "lrn_pub_YOUR_KEY",
  filename: "script.lua",
  includeAntiTamper: true
});
LuaRNAPI.download(result);

When server processing is enabled, Lua source is sent to LuaRN over HTTPS and processed by the configured Worker. Local browser fallback keeps source on the device but must reconstruct code to execute it. Verify /v1/health before relying on remote processing. Create a separate origin-bound key for each website.

3. API reference

Endpoints and operating model.

LuaRNAPI.obfuscateRemote(source, options)Sends Lua over HTTPS to the Worker when the server engine is enabled. Requires a public API key registered for the website origin.
data-luarn-widget + data-luarn-api-keyCreates a copy-paste widget automatically; no inline JavaScript is required.
GET /v1/health · POST /v1/authorizePublic health endpoint and origin-bound authorization. Public keys are not admin secrets.
POST /v1/keys · GET/PATCH/DELETE /v1/keysSelf-service key creation and owner-token management. Global analytics remain admin-only.
dailyLimit / expiresAtEach key can have its own daily quota and optional expiration. Expired keys are denied and automatically revoked by the scheduled cleanup.

Traffic analytics are retained for 30 days and store request metadata, not Lua source or raw IP addresses. Public keys are visible in website code by design; they are restricted by origin and quota, not treated as secret credentials. Non-browser clients can forge Origin headers, so quotas and server-side monitoring still matter. The current direct-upload package bundles the server engine in the Pages Worker. If the API is unavailable, open /v1/health and check engineInitialized, serverProcessingEnabled, and databaseReachable. Python bots can create private lrn_srv_ keys from the public /api-keys.html portal without an admin token; see /API-QUICKSTART.md. Keep bot keys in server-side secrets, never in browser HTML.

Get an API key ↗Open API example ↗Check API health ↗
✓Done