---
url: https://docs.sunlicense.com/guide/free-tools.md
---
# Free tools

[sunlicense.com/tools](https://sunlicense.com/tools) has free tools anyone can use without an account, in all ten
languages of the site. They're useful on their own; when you want more, a free SunLicense account does the full job.

| Tool | What it does | Where it runs |
|---|---|---|
| [License key generator](https://sunlicense.com/tools/license-key-generator) | Random, unique keys in the format you choose (groups, characters per group, prefix, separator, character set, lower case), up to 1,000 at a time; copy them or download a CSV with a `license_key` column | In your browser |
| [Lua obfuscator](https://sunlicense.com/tools/lua-obfuscator) | Up to 5 KB of Lua 5.1 or LuaU, obfuscated with [Prometheus](https://github.com/prometheus-lua/Prometheus) | On SunLicense's task worker |
| [JavaScript obfuscator](https://sunlicense.com/tools/javascript-obfuscator) | Up to 5 KB of JavaScript, obfuscated with [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator) | On SunLicense's task worker |
| [Java and Minecraft plugin obfuscator](https://sunlicense.com/tools/java-obfuscator) | Reads a pasted `plugin.yml`, `paper-plugin.yml`, `bungee.yml`, `velocity-plugin.json` or `fabric.mod.json` and lists the classes that must keep their names | In your browser |

## License key generator

Keys come from your browser's cryptographic random generator (`crypto.getRandomValues`), every character equally
likely. The default format is SunLicense's own: four groups of four from an alphabet without look-alikes (no `0`/`O`,
no `1`/`I`/`L`), about 79 bits of randomness. The page warns below 64 bits. Nothing is sent anywhere.

To use the keys with SunLicense, send them to us as a CSV with
[Import from another license system](./imports-and-tasks#moving-from-another-license-system), or let SunLicense issue
keys itself, in your own format on Lite and Standard with [key designs](./key-designs).

## Lua and JavaScript obfuscators

Paste a snippet and press **Obfuscate**. The settings are fixed:

* **Lua**: Prometheus with strings encrypted, constants moved into a shuffled array, numbers turned into expressions,
  everything wrapped in a function and names mangled, for Lua 5.1 (FiveM, Garry's Mod, LÖVE) or LuaU (Roblox). The
  dashboard's [Lua obfuscation](./obfuscation#lua-and-fivem-resources) adds the stronger presets (with a virtual machine) and whole
  resources.
* **JavaScript**: javascript-obfuscator's string array (base64-encoded), hexadecimal names and control-flow
  flattening; global names are kept. The dashboard's [JavaScript obfuscation](./obfuscation#javascript-and-typescript)
  takes whole files and projects, TypeScript included, with your own options.

Limits: **5 KB** (5,120 bytes) per snippet, **10 runs a day** per network, one snippet at a time across everyone
(others wait a moment or are asked to try again), 15 seconds per run. A bot check (Cloudflare Turnstile) may appear.
Your snippet is held in memory only while it's obfuscated: it isn't written to disk, logs or the database, and the
result is never kept. Don't paste secrets: obfuscation makes code harder to read, not impossible.

The free tools only run when the task worker isn't busy with an organization's task; when it is, the page asks you
to try again in a minute.

## Java and Minecraft plugin checker

Paste your descriptor and the page lists every class the server loads by name, split into what SunLicense's
[Java obfuscation](./obfuscation#your-plugin-still-loads) keeps by itself and what to add to **Keep unrenamed**: a
`paper-plugin.yml`'s `bootstrapper` and `loader`, for example. Fabric mixin configs are listed by file; the worker reads
them from your jar. The descriptor is read in your browser and never uploaded.

## API

The obfuscators call `POST /api/v1/tools/obfuscate` on `sunlicense.com` with
`{ "language": "lua" | "javascript", "luaVersion": "Lua51" | "LuaU", "code": "…", "turnstileToken": "…" }`. It answers
`{ "output", "millis", "engine" }`, or an error with a `code`: `too_large` (413), `invalid_code` (422, with the
engine's `detail`), `timed_out`, `output_too_large` (422), `tool_limit` (429, `Retry-After`), `captcha_required` (400),
`tools_busy`, `tools_off`, `captcha_unavailable` (503). It's meant for the page; use the
[obfuscation API](./obfuscation) with an account for anything automated.