'%20/%3e%3crect%20x='.5'%20y='.5'%20width='47'%20height='47'%20rx='11.5'%20stroke='%23ffffff'%20stroke-opacity='.08'%20/%3e%3cpath%20d='M24%209%2037%2014v10c0%208-6%2013.500-13%2016C17%2037.500%2011%2032%2011%2024V14L24%209Z'%20fill='url(%23shield)'%20/%3e%3cpath%20d='M21.200%2017.500%2020%2030.500M27.800%2017.500%2026.600%2030.500M16.600%2022h14.800M16.200%2026.200H31'%20stroke='%230c0c0d'%20stroke-width='2.300'%20stroke-linecap='round'%20/%3e%3c/svg%3e){kind=small}
Identifier Renaming
Rename classes, fields and methods in Alphabet, Invisible or IlIl style.
Rename Classes, fields and methods
Invisible client-1.7.10
C PlayerController Renamed IlIlIlIlIl
M tickPlayer lIIlIlIl
F health lIlIllII
Java bytecode obfuscator
Obfuscate your jars before they ship.
Rename, encrypt and reshape Java bytecode with a headless CLI or a Gradle plugin, built on ASM 9.9.
Join the waitlist Join the waitlist
No credit card required
Built for Minecraft clients first, works on any JVM bytecode.
- Java 25
- Gradle
- ASM 9.9
- Minecraft 1.7.10
- JVM bytecode
- Headless CLI
- Per-slot jars
- Java 25
- Gradle
- ASM 9.9
- Minecraft 1.7.10
- JVM bytecode
- Headless CLI
- Per-slot jars
- Java 25
- Gradle
- ASM 9.9
- Minecraft 1.7.10
- JVM bytecode
- Headless CLI
- Per-slot jars
Product Overview
HashGuard at a Glance
Follow one run through the pipeline: every transformer has a phase and runs in a fixed order.
client-1.7.10
Filter Display
Running 1
T-08 string: shard and encrypt string pools STRING Balanced
Queued 2
T-07 flatten: turn control flow into a state machine CONTROL_FLOW Heavy
T-06 constant: mask numeric constants CONTROL_FLOW Flow
Disabled 2
T-05 crasher: break common decompilers STRUCTURE Off
T-04 sensitiveVm: virtualize selected methods PRE_RENAME Off
Done 2
T-03 antiTamper: detect agents and debuggers PROTECT_EARLY On
T-02 rename: classes, fields and methods RENAME Invisible
Skipped 2
T-01 polyString: per-class XOR decryptor STRING Off
T-00 jntPolyString: per-call-site decryptor STRING Off
Control-Flow Flattening
Turn method bodies into switch-driven state machines with opaque predicates.
Output size budget 1.4x / 2.0x
Control flow
flatten Loop-aware Mode
controlFlow Heavy Mode
gotoObfuscation 13 variants Mode
flowShuffle Blocks Mode
String and Constant Encryption
Shard and encrypt string pools, and mask numeric constants.
String pools Algo: AES-128 CTR
Passes / client-1.7.10
string Done
constant Done
numberSpeck Queued
integerTable Queued
Annotation API
Keep names and signatures readable with @KeepName and @KeepSignature.
Kept as written Declared with the :api module
Class PublicApi Keep
ApiClient Keep
ConfigKeys Keep
Call Indirection
Calls become invokedynamic sites backed by encrypted blobs.
Anti-Tamper
Detects agents and debuggers at runtime.
Class Encryption
magicCrypter encrypts every class with AES-128-CTR.
Gradle Plugin
Apply the plugin, run plrObfuscate and get one jar per slot.
Benefits
Built for Your Build Pipeline
From the first rename to the last invokedynamic rewrite, every pass is made to run unattended in CI.
Headless CLI
Run it from a JSON config in CI, with no GUI in the way.
Per-Slot Jars
One plrObfuscate task builds up to 100 jar slots for your client.
Ordered Pipeline
Six phases keep every pass in a safe, fixed order.
Size Budget
maxOutputRatio stops heavy passes before the output outgrows your limit.
Keep What You Need
Annotations and exclude rules keep reflection and serialization safe.
Readable Stack Traces
Export a mapping file to decode obfuscated traces in your profiler.
45
Transformers
100
Jar slots per build
5
Preset profiles
Pricing
Simple Licence Plans
Starter
€19 per licence / month
For a single project
Get Started Get Started
Licence checked once per run
What’s Included
- Included: Renaming and shuffling
- Included: String encryption
- Included: Control-flow flattening
- Not included: Opaque predicates
- Not included: invokedynamic indirection
- Not included: Anti-tamper and integrity
- Not included: magicCrypter class encryption
Studio
Most Popular€49 per licence / month
Get Started Get Started
Licence checked once per run
What’s Included
- Included: Renaming and shuffling
- Included: String encryption
- Included: Control-flow flattening
- Included: Opaque predicates
- Not included: invokedynamic indirection
- Not included: Anti-tamper and integrity
- Not included: magicCrypter class encryption
Enterprise
€149 per licence / month
Get Started Get Started
Licence checked once per run
What’s Included
- Included: Renaming and shuffling
- Included: String encryption
- Included: Control-flow flattening
- Included: Opaque predicates
- Included: invokedynamic indirection
- Included: Anti-tamper and integrity
- Included: magicCrypter class encryption
All Plans Include
- Headless CLI
- Gradle plugin
- API annotations
- Mapping output
- Exclude rules
- Per-slot jars
- Java 8 fallback
- Licence check
Pipeline
Six Phases, One Ordered Pipeline.
Transformers run in phase order, from renaming to the final dynamic pass, so each protection builds on the last.
6
Ordered pipeline phases
45
Built-in transformers
Assign Reviewer
Configuration
Dial In Your Protection Profile
- Start from a profile: Ghost, Low, Medium, High or Extreme.
- Override any transformer with explicit options in the config.
- Exclude classes and members per transformer with simple rules.
- Keep names and signatures with @KeepName and @KeepSignature.
Our Team
Meet the Makers
Compatibility
Built for Every JVM
HashGuard works on plain JVM bytecode. Minecraft 1.7.10 clients on Java 25 come first, and string encryption keeps a Java 8 compatible fallback.
Minecraft clients first
Primary target runtime
String encryption fallback
Testimonials
What Developers Say
The Gradle plugin dropped into our build in minutes, and every release now ships protected.
Renaming plus string encryption took our decompiled output from readable to unusable.
Per-slot jars make it easy to rotate our client builds without touching the game code.
FAQ’s
Frequently Asked Questions
A Java bytecode obfuscator by Polar Studios, built on ASM 9.9. It runs as a headless CLI or through a Gradle plugin, and works on plain JVM bytecode with Minecraft 1.7.10 clients on Java 25 as the first target.
Minecraft 1.7.10 clients running on Java 25 are the primary target, and any JVM bytecode can be processed. String encryption has a Java 8 compatible invokedynamic fallback, and the engine itself is built with a Java 25 toolchain.
magicCrypter replaces the CAFEBABE header and encrypts every class with AES-128-CTR and zlib. It requires the PLR JVM (PLR-JAVA-25), a patched JVM that decrypts classes at load time with the slot keys. Without those keys the classes fail with a ClassFormatError.
Renaming changes names, so anything looked up by name must be kept. Annotate it with @KeepName or @KeepSignature, use @NoObfuscation or @ExcludeTransformers, or add an exclude rule. The access transformer already skips @SerializedName fields so Gson keeps working.
Apply the fr.polargames.plr-obfuscator plugin and set inputJar, configFile and slotCount in the plrObfuscator block. Then run ./gradlew plrObfuscate, which writes the obfuscated jars to build/plr-obfuscated.
slotCount (1 to 100) makes one run produce that many jars. Each slot gets its own random seed and derived AES and HMAC keys, written to keys-manifest.json. Seeds are never stored, so every build rotates the keys.
The CLI validates your customer licence once before any obfuscation work starts, including multislot runs. Provide the key with PLR_LICENCE_KEY or the OS keyring. The source repository itself is MIT licensed, as a heavily rewritten fork of Bozar.
45 transformers run in six phases, from renaming and string encryption to control-flow flattening, invokedynamic indirection, ghost members, anti-tamper and integrity checks. Profiles from Ghost to Extreme set the baseline, and explicit options override it.
Some transformers add runtime cost. maxOutputRatio caps the output at a multiple of the input instruction count (the sample config uses 2.0), and heavy passes such as flattening stop once the budget is spent. Flattening loops is a separate option because it costs more on hot loops.
Set mappingOutput and HashGuard writes an old-to-new name mapping as JSON. You can feed it to JProfiler or any other tooling to translate obfuscated names back.
Get Started
Start Protecting Your Builds
Leave your email and Polar Studios will get back to you about access. The CLI checks your licence once, before any obfuscation work starts.
- Licence checked once per run
- Gradle plugin included
- Works on any JVM bytecode
Transformers
Pipeline phases
Built-in profiles
Slot jars per build, max