✳ A CLEANER LUA WORKFLOW

Your Lua.
Refined. Packed. Ready.

A focused Lua protection workspace with conservative token-based transformation, per-build payload packing, and a runtime integrity guard. Client-side code can still be captured at runtime.

✓ Local-first processing ✓ Per-build payloads ✓ Verified packing

THE WORKSPACE

Process a Lua script

Upload a .lua file to transform and pack it. The browser fallback keeps the source on this device; private server processing is used only when the health endpoint confirms it is available.

Starting LuaRN engines…

Source file

Choose the Lua source you want to protect.

01 / INPUT

Drop your .lua file here

ONLY .LUA FILESMAX 1 MB

Only .lua uploads are accepted. When the private server is offline, the browser fallback keeps Lua source on this device and does not upload it.

Include runtime integrity guardAdds a small runtime and payload-length guard before your script. It avoids executor fingerprinting and crash loops; it cannot prevent runtime inspection. OFF

Every build uses payload masking, integrity checks, comment/format removal, string-literal encoding, and conservative local-identifier renaming. These raise the effort needed to read a dump; the loader still reconstructs executable Lua at runtime.

Integrity checks are intentionally non-invasive. They detect malformed runtime inputs, not all tampering or code inspection. Keep sensitive business logic on a trusted server instead of relying on client-side secrecy.

Output format Both formats use LuaRN's own loader format and payload integrity check. Compact mode removes comments and collapses whitespace outside strings.

Upload a Lua file. If the private server is offline, LuaRN processes it locally in your browser.

Output preview

Your output uses LuaRN’s packed-loader format, per-build payload transformation, integrity checks, and conservative local-name obfuscation. Runtime integrity checks are optional. No client-side output is guaranteed undumpable.

02 / OUTPUT

No output generated yet

Upload a .lua file for obfuscation and preview the downloadable result. Browser processing is available if the private server is offline.

OUTPUT CANVAS

Always test generated files in a safe environment before use.

Starting LuaRN engines

LuaRN uses private server processing only when the health endpoint confirms it is available. Otherwise, the browser fallback runs on this device. Test output in the actual target runtime.

Upload

Select a .lua file; browser fallback keeps source local.

Transform & pack

Remove noise, rename eligible locals, and package the payload.

Export

Preview, copy, or download the .lua result.

DEVELOPER ACCESS

LuaRN API & SDK

Integrate LuaRN into an HTTPS website when the API service is active. Self-service keys, quotas, and origin checks are provided by the protected Worker configuration.

API v1.5.0

1. Create your own API key

When the API service is active, you can create a key for your HTTPS website without an administrator token. The portal gives you a public API key, a private key-management token, and a ready-to-paste official embed snippet. Your management token controls only your own key.

Get an API key ↗

When self-service API management is online, customers can manage their quota or revoke their own key. The private ADMIN_TOKEN remains reserved for site administration and analytics.

2. Add the LuaRN SDK

Load the hosted SDK, then use your key that was registered for the exact HTTPS origin of the current website.

<div id="luarn-api-widget"></div>
<script src="https://luarn.pages.dev/api-sdk.js?v=150" defer data-luarn-widget data-luarn-brand="LuaRN Obfuscator" data-luarn-target="#luarn-api-widget" data-luarn-api-key="lrn_pub_YOUR_KEY"></script>

Server-side processing (when enabled)

const result = await LuaRNAPI.obfuscateRemote(luaSource, {
  apiKey: "lrn_pub_YOUR_KEY",
  filename: "script.lua",
  includeAntiTamper: true
});
LuaRNAPI.download(result);

When server processing is enabled, Lua source is sent to LuaRN over HTTPS and processed by the configured Worker. Local browser fallback keeps source on the device but must reconstruct code to execute it. Verify /v1/health before relying on remote processing. Create a separate origin-bound key for each website.

3. API reference

Endpoints and operating model.

LuaRNAPI.obfuscateRemote(source, options)Sends Lua over HTTPS to the Worker when the server engine is enabled. Requires a public API key registered for the website origin.

data-luarn-widget + data-luarn-api-keyCreates a copy-paste widget automatically; no inline JavaScript is required.

GET /v1/health · POST /v1/authorizePublic health endpoint and origin-bound authorization. Public keys are not admin secrets.

POST /v1/keys · GET/PATCH/DELETE /v1/keysSelf-service key creation and owner-token management. Global analytics remain admin-only.

dailyLimit / expiresAtEach key can have its own daily quota and optional expiration. Expired keys are denied and automatically revoked by the scheduled cleanup.

Traffic analytics are retained for 30 days and store request metadata, not Lua source or raw IP addresses. Public keys are visible in website code by design; they are restricted by origin and quota, not treated as secret credentials. Non-browser clients can forge Origin headers, so quotas and server-side monitoring still matter. The active deployment configuration determines whether this endpoint can process scripts; the direct-upload fallback may report the server engine as disabled.

Get an API key ↗Open API example ↗Check API health ↗

Your Lua.Refined. Packed. Ready.