How do I protect my client-side JavaScript code?

This has been asked thousands of times over the past few years. Everyone wants to know how they can prevent nosy people from viewing or stealing their JavaScript. I have always responded with: 
 
    "If my browser can read it, so can I." 
    "If you don't want people to steal your JavaScript, don't put it on the web." 
 
I have also often thought the following: 
 
    "If your Javascript is so revolutionary, you should probably be able to figure this out too." 
    "And if someone does steal your script, consider it a compliment." 
 
In the past, many people have suggested ways to slow people down, and discourage casual, non-persistent people. But there has never been a way to stop anyone with a little more resourcefulness than your average house fly. <G> 
 
Some of the solutions that have been offered in the past, and their workarounds: 
 

Proposed fix	Workaround(s)
Load the JS in a new window, with toolbar disabled	- view source by right-clicking within the window
Disable right-click by capturing oncontextmenu	- disable Javascript temporarily  - use a browser that doesn't support oncontextmenu  - load 'view-source:<url>'
Use JavaScript across frames, iframes, ilayers	- not difficult to find the proper page
Use JavaScript to write JavaScript	- disable JavaScript temporarily
'Hide' the script using a remote JS file	- the .js file is in your cache
Encode the script using an encoder	- Microsoft's encoder was broken easily; perhaps you can write a better one
Obfuscate with unSpace or similar tools	- all this does is obfuscate, it doesn't make it hard to copy at all
All of the above	- a resourceful person will still be able to see your script, even if you employed all of the above at once

 
 
Other legitimate ways to view JavaScript sent to the browser is by using packet sniffing technology,  
 
Here is a funny excerpt from a post by Jeff Cochran, back in 1997: 

Put the source on a floppy disk and bury it in a mason jar in your back yard. Make sure you delete all references to it from your system. To be extra sure, bury it blindfolded at night so you can't remember where it is in case foreign spies try to beat the location out of you.

Of course, you could write it as a Java Applet to make it tougher to figure out, but then, if you knew how to do that you'd probably also be able to write something really worth protecting...

Jeff

PS: The mason jar trick works well to protect your .GIF files from being downloaded too...

 

---

 
UPDATE October 30, 2001 
 
After many attempts at hiding my JavaScript code, I was thwarted every single time - by people using tactics ranging from intuitive to downright clever. 
 
Once again, I have to tell you... if you need to hide your JavaScript code, you probably shouldn't put it on the web.