Obfuscator & Tiers
The Obfuscator is a web tool in your client area: paste Luau, pick one of five tiers (Standard, Strong, Maximum, Hyper, or the Quantum VM), and get a protected build that runs bit-for-bit like your source. There is no download and nothing to install — protection happens server-side, behind your license.
Where the Obfuscator lives
Open Obfuscator in the client area. You must be signed in and Discord-verified — verification gates the whole client area, and your tier is read from your Discord server roles (see Discord Link & Tiers). The tool has three tabs:
- Obfuscate — paste your source, choose a tier, and copy the protected build.
- History — every build you have made, ready to copy again.
- Recover — staff-only; reverses a Quark build back to its original source (see the recovery vault below).
On Discord, the bot's /obfuscate command does the same thing and uses the same invite model for the free tier.
Free vs. paid: the invite model
Paid tiers (Basic, Premium, Dominus) get unlimited obfuscations. The Free tier runs on invite credits: 1 verified invite = 1 obfuscation.
In the Obfuscate tab, enter the Discord @username you are going to invite.
They must join within 5 minutes and pass the anti-alt check — a real avatar and an account at least 7 days old.
The Discord bot grants the credit on join, and a build unlocks in the tool automatically. Spend it here or with /obfuscate in the bot.
The same 1-invite model powers the free Account Generator tier. Want unlimited obfuscations instead? A paid tier removes the invite gate entirely — see Discord Link & Tiers.
All tiers target Luau and execute 100% correctly. The obfuscator is behavior-preserving: your protected build runs exactly like the source you pasted. The tiers differ only in how hard the output is to read and reverse, and in how the code is represented.
The four source tiers
Standard, Strong, Maximum and Hyper are all source-based. They transform your Luau source into heavily protected Luau that still ultimately runs as Luau. Each tier builds on the one below it, layering more transformation on top.
Standard
The baseline. Your source is encrypted with ChaCha20 and unpacked at runtime, so the build that ships is ciphertext plus a small decryptor rather than plaintext Lua. This stops casual copy-paste theft and trivial reading of the file.
Strong
Everything in Standard, plus additional layers of nesting. The decryption and unpacking are wrapped in multiple stages so there is no single, obvious point where plaintext appears. An attacker has to work through more than one layer instead of one.
Maximum
Everything in Strong, plus control-flow flattening. The natural structure of your code (its loops, branches and function order) is rewritten into a flattened dispatch form so the original logic is much harder to follow even once a layer is decrypted. Reading the code no longer tells a reverser what it does at a glance.
Hyper
The strongest source tier. Everything in Maximum, plus ciphertext fragmentation: the encrypted payload is split into many pieces that are reassembled at runtime, so there is no single contiguous blob to lift out. Hyper combines ChaCha20 encryption, deep nesting, control-flow flattening and fragmentation into one output.
Honest limit of all source obfuscation: because the code still ends up running as Luau, a determined attacker can hook load() (or loadstring) and dump each decrypted layer as it is produced, peeling the layers one by one until they reach plaintext. This is true of Standard, Strong, Maximum and Hyper alike. It is a fundamental property of source-based obfuscation, not a flaw specific to Quark. More layers raise the effort required; they do not make the dump attack impossible.
Quantum: the VM tier
Quantum is a different kind of protection, and it is the real defense against the dump attack described above. Instead of shipping protected Luau, Quantum compiles your script to a per-build custom VM with its own opcode set. The output is an interpreter plus a stream of opcodes. If an attacker hooks load() and dumps what runs, they get opcode numbers for a bytecode format that only that build's VM understands, not readable source. To recover your logic they would have to reverse-engineer the custom VM itself, which is a far larger task than peeling decrypted layers.
Hard-gated for correctness
Quantum is hard-gated. If it encounters a construct in your script that it cannot compile to the VM with a correctness guarantee, it refuses rather than emitting something that might misbehave, and it falls back to Hyper for that build. It never silently ships a VM output it is unsure about.
Verified in a real Luau VM
Every Quantum output is verified by running it in a real Luau VM before it is accepted, so the compiled build is confirmed to execute correctly. Combined with the hard gate, this means Quantum either produces a verified, correct VM build or steps down to Hyper. You never get a broken build.
Nothing running inside an executor is truly unbreakable, and Quantum does not claim otherwise. Anything that can run your code can, in principle, be reversed with enough effort. What Quantum does is raise the bar of the dump attack from "peel a few decrypted layers" to "reverse-engineer a custom virtual machine."
Tier comparison
| Tier | Representation | What it adds | Dump resistance |
|---|---|---|---|
| Standard | Source (Luau) | ChaCha20 encryption of your source | Peelable to plaintext |
| Strong | Source (Luau) | Standard + additional nesting layers | Peelable to plaintext |
| Maximum | Source (Luau) | Strong + control-flow flattening | Peelable to plaintext |
| Hyper | Source (Luau) | Maximum + ciphertext fragmentation (strongest source tier) | Peelable to plaintext, but the highest effort of the source tiers |
| Quantum | Custom VM / opcodes | Compiles to a per-build opcode set; hard-gated and verified in real Luau | A dump yields opcodes, not source; requires reversing the custom VM |
Choosing a tier
- Pick a source tier (Standard through Hyper) when you want fast, behavior-preserving protection and accept that a determined attacker could eventually dump the source. Hyper is the strongest of these.
- Pick Quantum when protecting your source against the dump attack matters most and you want the highest bar Quark offers. Remember it may fall back to Hyper if your script uses a construct it cannot guarantee, so a Quantum build is always at least as protected as Hyper.
Server-side protection & the recovery vault
Obfuscation runs entirely on Quark's servers, behind your license — you never install a tool and your source never leaves the platform to be processed elsewhere. Because every build is made server-side, the platform can also keep a safety net: each build is fingerprinted into a recovery vault at the moment it is created.
The vault is what makes deobfuscation possible. Using a build's fingerprint, staff can reverse any Quark-made output back to its original source from the Recover tab — so a lost script can always be brought back.
Recovery is staff-only. There is no self-serve way to reverse a Quark build; if you need one inspected or recovered, that is handled by staff, not through a public tool.
The History tab
Every obfuscation you run is saved to your History tab — the tier you used, the source and output sizes, and the protected build itself, ready to copy again. Nothing is lost if you close the tab, and you can pull an earlier build back at any time without re-running it.
Protecting your key systems
The same obfuscator also protects scripts delivered through a key system. When you publish one, your source is obfuscated at your chosen tier server-side and only ever delivered after a valid key + HWID check — the real source is never exposed at a public URL. See Create a Key System and The Loader & Delivery for that flow.
Questions about which tier fits your script, or hit a Quantum fallback and want to understand why? Ask in the community Discord at discord.gg/AvfJCzRgUz.