How do I hide a variable value in JavaScript?

Question

I am currently working on a JavaScript project and know that JavaScript source code is accessible through the browser. In the code, I have a variable that stores a secret string that is used by the program. However, I do not want others to view the source code and find out the value of this variable. Is there a way to hide the value of a variable? Or is it possible to change the variable value after? For instance, change the actual source code to set the variable to a different value? This variable is only used the first time an image is loaded so it would be okay to remove it altogether if that is possible.

That's totally impossible; the attacker has full control over the debugger. — SLaks
– SLaks, Commented Mar 6, 2015 at 1:14
Whatever you're doing sounds insecure. Reconsider your approach. — royhowie
– royhowie, Commented Mar 6, 2015 at 1:14
@SLaks, How do an attacker inject a debugger keyword on a (function(){ const x = prompt("give me a secret"); ... })()? — user985399
– user985399, Commented Jul 11, 2019 at 2:00
@SLaks, It is not possible to access client browsers devtools without them notice the browser console is open. If you mean on client side the attacker must have access to server to do the insider job. What you say is totally impossible. — user985399
– user985399, Commented Jul 11, 2019 at 15:12

Nelson · Accepted Answer · 2015-03-06 02:16:02Z

6

You cannot hide JavaScript content from a programmer. They can always open the developer console and get all your variables.

What's worse, they can use said console to directly bypass any JavaScript validation, so it cannot be your primary security.

If it is something you must hide or secure against, you must look into a server side solution.

answered Mar 6, 2015 at 2:16

Nelson

2,2351 gold badge19 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

user985399 Over a year ago

There is fairly safe CDN servers where to put the code, so we can exclude manipulation ones uploaded. At client side the programmers don't come home and open your console. Because this answer is accepted the post owner did not have a variable that stores a secret string. It was probably a hardcoded string, not a secret string.

Nelson Over a year ago

We're not talking about securing source code. We're talking about securing variable values. That is literally impossible. Getting JS variable value is trivially easy.

user985399 Over a year ago

by just say someone is plain wrong does not make sense to anything you say. I have not claimed that Javascript variable is "impossible"! I could claim that Javascript variable is possible to store a secret - but that would not be possible because your kind work in teams.

user985399 Over a year ago

This answer should be removed because it is just a "fact" based on "a sense of security" and if questioned it seem to be based on wild imaginations with no fundamental understanding about how browser console work.

Tom Dyer · Accepted Answer · 2015-03-06 01:14:54Z

1

Javascript is run on the client, so I don't think this is going to possible. Anything that you need to be kept secret is going to need to be server side.

answered Mar 6, 2015 at 1:14

Tom Dyer

4522 silver badges10 bronze badges

1 Comment

user985399 Over a year ago

Javascript is isomorphic so it run on server too

Parzh · Accepted Answer · 2022-05-08 08:55:18Z

What you ask is impossible at the moment.

But there's a JavaScript proposal Function implementation hiding, which – as the name suggests – hides function implementation from being observed. The proposal originated in mid-2019, and is in stage 2 (out of 4) at the moment. I personally doubt that it will ever be part of the standard, but if it does, in theory you could hide the secret inside of the body of a hidden function:

function fetchData() {
  "sensitive"; // ← the proposal

  const SECRET = "VGhlIG1lc3NhZ2UgaXM6IFIyeHZjbmtnZEc4Z1ZXdHlZV2x1WmZDZmg3cnduNGVt";

  return fetch(DATA_URL, {
    headers: {
      "Authorization": `Bearer ${SECRET}`,
    },
  });
}

The SECRET variable cannot be inspected through debugger or through fetchData.toString(). However, the value of Authorization header is visible in a network tab in console, so the whole thing is inappropriate for this use case.

unbindall · Accepted Answer · 2015-03-06 01:26:06Z

-1

JavaScript is client side, and there isn't really anyway to hide the code.

What you can do: Prevent common users from seeing it (aka making it harder to find)

My suggestion is to encrypt the data using some sort of cipher (preferably not an online encryption tool). This stops most lazy people from seeing it.

(Assuming no one is actually trying to find this mysterious value)

answered Mar 6, 2015 at 1:26

unbindall

5241 gold badge14 silver badges30 bronze badges

Comments

Alem · Accepted Answer · 2022-05-08 08:17:55Z

-3

Well, you can just put the entire code into one function and then execute it after that in the same script. That helped me.

answered May 8, 2022 at 8:17

Alem

3033 silver badges14 bronze badges

Collectives™ on Stack Overflow

How do I hide a variable value in JavaScript?

5 Answers 5

4 Comments

1 Comment

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

4 Comments

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related