Overview

FlareFuscator is the obfuscator behind FlareKey. It takes Luau source you wrote and returns a protected build that behaves the same but is far harder to read, edit, or lift wholesale. You use it from the dashboard's obfuscation studio, from the management API, or as the protection applied to a script you deliver through FlareKey licensing.

What it is for

• Raising the cost of reading and modifying a released script. Names are rewritten, control flow is restructured, literals are protected, and the result runs on a runtime the reader has to understand before the code makes sense.
• Protecting logic you ship to a machine you do not control - a Roblox client - where the code has to be present in order to run.
• Pairing with FlareKey licensing so a build is delivered only to a verified session, through a single-use ticket, rather than sitting in a public file.

Presets

Preset	ID	Daily runs (Free)	Monthly runs (Free)	What it does
Maximum	maximum	2	30	Strongest protection. New distributed native runtime.

• The run counts above are Free-plan quotas. Basic and every paid plan above it run every preset without a per-day or per-month cap.
• Obfuscation requires a signed-in account. Guests who press Obfuscate are sent to the login page.

Limitations

• Obfuscation is not encryption. Everything the protected script needs in order to run is present on the machine running it, so a determined reader with enough time can recover behaviour. The goal is cost, not impossibility.
• Protected builds are larger and slower than the source they came from. How much depends on the preset and on how much of the script ends up on the virtualized path.
• Some macros are recorded as compiler metadata but do not yet change the generated code. As of this build that applies to 10 of the 21 macros - each one is marked "Directive only" on the Macros page.
• The input is Luau. Source that depends on a non-Roblox runtime, or on loading further code at runtime from somewhere FlareFuscator cannot see, is protected only as far as the text it can read.

Security awareness

• Never put a secret in a client script and rely on obfuscation to hide it. API keys, webhook URLs, admin tokens and database credentials belong on a server the user cannot reach.
• A protected build still executes. Anything the script is allowed to do, an attacker who runs it is also allowed to do - so authorize actions on the server, not in the client.
• FLARE_ENCSTR and FLARE_ENCNUM protect a literal at rest in the build, not at the moment it is used. The plaintext exists briefly while the value is being read.
• Treat every protected release as eventually readable. Rotate anything that leaking would hurt, and design so that a lifted script is worth little without a valid license.

Where to go next

Macros lists every compile-time directive and what it currently does. Plan Limits covers the quotas that apply to your account.