In software development, obfuscation is the deliberate act of creating source or machine code that is difficult for humans to understand. Like obfuscation in natural language, it may use needlessly roundabout expressions to compose statements. Programmers may deliberately obfuscate code to conceal its purpose (security through obscurity) or its logic or implicit values embedded in it, primarily, in order to prevent tampering, deter reverse engineering, or even as a puzzle or recreational challenge for someone reading the source code. This can be done manually or by using an automated tool, the latter being the preferred technique in industry.^[1]

The architecture and characteristics of some languages may make them easier to obfuscate than others.^[2][3] C,^[4] C++,^[5][6] and the Perl programming language^[7] are some examples of languages easy to obfuscate.

Writing and reading obfuscated source code can be a brain teaser. A number of programming contests reward the most creatively obfuscated code, such as the International Obfuscated C Code Contest and the Obfuscated Perl Contest.

Types of obfuscations include simple keyword substitution, use or non-use of whitespace to create artistic effects, and self-generating or heavily compressed programs.

According to Nick Montfort, techniques may include:

Short obfuscated Perl programs may be used in signatures of Perl programmers. These are JAPHs ("Just another Perl hacker").^[9]

This is a winning entry from the International Obfuscated C Code Contest written by Ian Phillipps in 1988^[10] and subsequently reverse engineered by Thomas Ball.^[11]

It is a C program that when compiled and run will generate the 12 verses of The 12 Days of Christmas. It contains all the strings required for the poem in an encoded form within the code.

A non-winning entry from the same year, this next example illustrates creative use of whitespace; it generates mazes of arbitrary length:^[12]

ANSI-compliant C compilers don't allow constant strings to be overwritten, which can be avoided by changing "*M" to "M[3]" and omitting "M=".

The following example by Óscar Toledo Gutiérrez, Best of Show entry in the 19th IOCCC, implements an 8080 emulator complete with terminal and disk controller, capable of booting CP/M-80 and running CP/M applications:^[13]

An example of a JAPH:

This slowly displays the text "Just another Perl / Unix hacker", multiple characters at a time, with delays. An explanation can be found here.^[14]

Some Python examples can be found in the official Python programming FAQ ^[45] and elsewhere.^[15][16][17]

There are several advantages of automated code obfuscation that have made it popular and widely useful across many platforms. On some platforms (such as Java,^[18] Android,^[19] and .NET) a decompiler can reverse-engineer source code from an executable or library. A main advantage of automated code obfuscation is that it helps protect the trade secrets (intellectual property) contained within software by making reverse-engineering a program difficult and economically unfeasible. Other advantages might include helping to protect licensing mechanisms and unauthorized access, and shrinking the size of the source code, and possibly shrinking the size of the executable. Decompilation is sometimes called a man-at-the-end attack, based on the traditional cryptographic attack known as "man-in-the-middle". For run-time interpreted languages (more commonly known as script), like older versions of BASIC, programs execute faster and take less RAM if they use single letter variable names, avoid comments and do not contain blank characters. (in brief, the shorter the faster)

While obfuscation can make reading, writing, and reverse-engineering a program difficult and time-consuming, it will not necessarily make it impossible.^[20] Some anti-virus software, such as AVG AntiVirus, will also alert their users when they land on a site with code that is manually obfuscated, as one of the purposes of obfuscation can be to hide malicious code. However, some developers may employ code obfuscation for the purpose of reducing file size or increasing security. The average user may not expect their antivirus software to provide alerts about an otherwise harmless piece of code, especially from trusted corporations, so such a feature may actually deter users from using legitimate software.

A variety of tools exist to perform or assist with code obfuscation. These include experimental research tools created by academics, hobbyist tools, commercial products written by professionals, and open-source software. There also exist deobfuscation tools that attempt to perform the reverse transformation.

Although the majority of commercial obfuscation solutions work by transforming either program source code,^[21][22] or platform-independent bytecode as used by Java^[23] and .NET,^[24] there are also some that work directly on compiled binaries.

There has been debate on whether it is illegal to skirt copyleft software licenses by releasing source code in obfuscated form, such as in cases in which the author is less willing to make the source code available. The issue is addressed in the GNU General Public License by requiring the "preferred form for making modifications" to be made available.^[25] The GNU website states "Obfuscated 'source code' is not real source code and does not count as source code." ^[26]