gobfuscate

Paid

What gobfuscate is

gobfuscate is a free, open-source command-line tool for building Go binaries from obfuscated source code. It changes package names and paths, global variable, constant, function and newly defined type names, most struct method names, and strings to make information in the resulting binary harder to read. It copies a subset of GOPATH and hashes package names and paths; this can remove details such as GitHub usernames from the executable. For strings, it substitutes functions that reconstruct values from masked bytes and attempts to turn string constants into variables.

Install it with `go get -u github.com/unixpickle/gobfuscate`, then run `gobfuscate [flags] pkg_name out_path`. Options include keeping tests, setting compiler tags, choosing an output directory, adding hash padding, controlling static and CGO-related build behavior, showing verbose output, and hiding a Windows GUI. The repository identifies it as BSD 2-Clause licensed. Its obfuscation has boundaries: CGO, assembly files and build constraints can prevent name changes, and methods matching imported interface methods stay unchanged. String constants in mixed const/int blocks are not converted successfully.

Who it suits

gobfuscate suits Go developers who want to build binaries with package, identifier and string obfuscation through a CLI. It may fit projects where a subset of GOPATH can be copied and package paths hashed, provided the code does not rely on name changes that its stated restrictions prevent.

What it does well

Free and open source under the BSD 2-Clause license.
Obfuscates package names and paths as well as identifiers.
Replaces strings with functions that reconstruct masked bytes.
Offers flags for tests, tags, output paths and build behavior.

What to know first

CGO packages restrict package-name, global-name and method obfuscation.
Assembly files and duplicate names from build constraints limit name changes.
Imported-interface method names remain unchanged.
Mixed const/int blocks prevent successful string-constant conversion.

Limits

CGO packages cannot have package names renamed, and CGO also prevents global-name and struct-method obfuscation under the stated restrictions. Assembly files and duplicate names from build constraints also restrict name obfuscation; string constants in mixed const/int blocks are not converted successfully.

Getting started

Install with `go get -u github.com/unixpickle/gobfuscate`.
Run `gobfuscate [flags] pkg_name out_path` with the package name and output path.
Set any desired flags, such as `-keeptests`, `-tags`, `-outdir` or `-verbose`.
Review CGO, assembly, build-constraint and mixed const/int block restrictions for the code being built.

Verdict

Choose gobfuscate if you want a free CLI for obfuscating Go binaries and its stated restrictions fit your code. Look elsewhere if you need anti-tamper controls or control-flow obfuscation, which it does not provide.

Questions

Is gobfuscate free?

Yes. It is listed as free and open source.

What license does gobfuscate use?

The repository identifies it as BSD 2-Clause licensed.

How do I install and run gobfuscate?

The README shows `go get -u github.com/unixpickle/gobfuscate` for installation and `gobfuscate [flags] pkg_name out_path` for use.

What does gobfuscate obfuscate?

It hashes package names and paths, global names, newly defined type names and most struct method names. It also replaces strings with functions that reconstruct them from masked bytes.

What are the limits on name obfuscation?

CGO, assembly files and names repeated because of build constraints restrict name changes. Methods matching methods of imported interfaces are not renamed.

Does gobfuscate provide anti-tamper or control-flow obfuscation?

No. The listed facts say it has neither anti-tamper controls nor control-flow obfuscation.

Facts from gobfuscate's own pages

Assembly limitation: Global names and struct methods are not obfuscated in packages that contain assembly files. · github.com, 10 Oct 2026
Build constraints: Global names and struct methods that appear multiple times because of build constraints are not obfuscated. · github.com, 10 Oct 2026
Build flags: The command supports flags including -keeptests, -noencrypt, -nostatic, -outdir, -padding, -tags, -verbose, and -winhide. · github.com, 10 Oct 2026
Build options: Flags include options for keeping tests, static linking, outputting a full GOPATH, compiler tags, verbose mode, custom hash padding, CGO-related build behavior, and hiding a Windows GUI. · github.com, 11 Oct 2026
CGO limitation: Packages using CGO cannot have package names renamed, and CGO also prevents global names and struct methods from being obfuscated. · github.com, 10 Oct 2026
Global names: It hashes global variable, constant, function, and newly defined type names. · github.com, 10 Oct 2026
Install and use: The README shows installation with `go get -u github.com/unixpickle/gobfuscate` and use as `gobfuscate [flags] pkg_name out_path`. · github.com, 11 Oct 2026
License: The repository describes the project as BSD 2-Clause licensed. · github.com, 11 Oct 2026
Limit: assembly and build constraints: Global names and struct methods are not obfuscated in packages with assembly files or when names appear multiple times because of build constraints. · github.com, 11 Oct 2026
Limit: CGO: Packages using CGO cannot have package names renamed, and CGO also prevents global-name and struct-method obfuscation under the stated refactoring restrictions. · github.com, 11 Oct 2026
Limit: constants: The README says converting string constants to variables does not work for mixed const/int blocks. · github.com, 11 Oct 2026
Limit: methods: Struct methods matching methods of imported interfaces are not renamed. · github.com, 11 Oct 2026
Maker: The GitHub owner profile identifies unixpickle as Alex Nichol and describes him as an AI researcher, hobby web developer, and math geek. · github.com, 11 Oct 2026
Method names: It hashes most struct method names, but leaves methods whose names match methods of imported interfaces unchanged. · github.com, 10 Oct 2026
Obfuscates: It manipulates package names, global variable and function names, type names, method names, and strings. · github.com, 11 Oct 2026
Package names: It copies a subset of GOPATH and hashes package names and paths to obscure them in the executable. · github.com, 10 Oct 2026
Package paths: It copies a subset of GOPATH and hashes package names and paths, which the README says can remove details such as GitHub usernames from the executable. · github.com, 11 Oct 2026
Purpose: gobfuscate compiles Go binaries from obfuscated source code to make source information in the binary difficult or impossible to decipher. · github.com, 11 Oct 2026
Release downloads: The GitHub releases page states that there are no releases for this repository. · github.com, 11 Oct 2026
String constant limitation: String constants in mixed const/int blocks are not converted successfully. · github.com, 10 Oct 2026
String handling: Strings are replaced with functions that XOR masked byte slices to reconstruct the string. · github.com, 11 Oct 2026

Where gobfuscate stands on Freedom251

Code Obfuscation Software#33 of 34