Obfuscator & Tiers
Every script you publish through Quark is obfuscated before it is ever served. Choose one of four source-based tiers (Standard, Strong, Maximum, Hyper) or the Quantum VM tier, which compiles your script to a custom opcode set so a dump yields opcodes instead of readable source.
Where obfuscation fits
Obfuscation is one layer of Quark's protection, not the whole of it. When you publish a key system, Quark obfuscates your source and returns a raw loader URL of the form https://quarkexploits.com/raw/ID.lua. The real script is never exposed at a public URL. Instead, the loader stub reads the buyer's script_key, collects HWID and player, game and hardware info, and POSTs to the server. Only after the server validates the key and HWID does it return the obfuscated real script. So obfuscation works alongside server-gated delivery, the HWID lock and server-side logging, not on its own.
All tiers target Luau and execute 100% correctly. The obfuscator is behavior-preserving: your script runs exactly as written. The tiers differ only in how hard the output is to read and reverse, and in how the code is represented.
The four source tiers
Standard, Strong, Maximum and Hyper are all source-based. They transform your Luau source into heavily protected Luau that still ultimately runs as Luau. Each tier builds on the one below it, layering more transformation on top.
Standard
The baseline. Your source is encrypted with ChaCha20 and unpacked at runtime, so the script that ships is ciphertext plus a small decryptor rather than plaintext Lua. This stops casual copy-paste theft and trivial reading of the file.
Strong
Everything in Standard, plus additional layers of nesting. The decryption and unpacking are wrapped in multiple stages so there is no single, obvious point where plaintext appears. An attacker has to work through more than one layer instead of one.
Maximum
Everything in Strong, plus control-flow flattening. The natural structure of your code (its loops, branches and function order) is rewritten into a flattened dispatch form so the original logic is much harder to follow even once a layer is decrypted. Reading the code no longer tells a reverser what it does at a glance.
Hyper
The strongest source tier. Everything in Maximum, plus ciphertext fragmentation: the encrypted payload is split into many pieces that are reassembled at runtime, so there is no single contiguous blob to lift out. Hyper combines ChaCha20 encryption, deep nesting, control-flow flattening and fragmentation into one output.
Honest limit of all source obfuscation: because the code still ends up running as Luau, a determined attacker can hook load() (or loadstring) and dump each decrypted layer as it is produced, peeling the layers one by one until they reach plaintext. This is true of Standard, Strong, Maximum and Hyper alike. It is a fundamental property of source-based obfuscation, not a flaw specific to Quark. More layers raise the effort required; they do not make the dump attack impossible.
Quantum: the VM tier
Quantum is a different kind of protection, and it is the real defense against the dump attack described above. Instead of shipping protected Luau, Quantum compiles your script to a custom VM with its own opcode set. The output is an interpreter plus a stream of opcodes. If an attacker hooks load() and dumps what runs, they get opcode numbers for a bytecode format that only Quark's VM understands, not readable source. To recover your logic they would have to reverse-engineer the custom VM itself, which is a far larger task than peeling decrypted layers.
Hard-gated for correctness
Quantum is hard-gated. If it encounters a construct in your script that it cannot compile to the VM with a correctness guarantee, it refuses rather than emitting something that might misbehave, and it falls back to Hyper for that publish. It never silently ships a VM output it is unsure about.
Verified in a real Luau VM
Every Quantum output is verified by running it in a real Luau VM before it is accepted, so the compiled script is confirmed to execute correctly. Combined with the hard gate, this means Quantum either produces a verified, correct VM build or steps down to Hyper. You never get a broken script.
Nothing running inside an executor is truly unbreakable. Quantum does not claim otherwise. The buyer's executor must be able to run your code, and anything that can run it can, in principle, be reversed with enough effort. What Quantum does is raise the bar of the dump attack from "peel a few decrypted layers" to "reverse-engineer a custom virtual machine." The overall protection remains server-gated delivery plus the HWID lock plus logging, with Quantum raising the dump bar significantly.
Tier comparison
| Tier | Representation | What it adds | Dump resistance |
|---|---|---|---|
| Standard | Source (Luau) | ChaCha20 encryption of your source | Peelable to plaintext |
| Strong | Source (Luau) | Standard + additional nesting layers | Peelable to plaintext |
| Maximum | Source (Luau) | Strong + control-flow flattening | Peelable to plaintext |
| Hyper | Source (Luau) | Maximum + ciphertext fragmentation (strongest source tier) | Peelable to plaintext, but the highest effort of the source tiers |
| Quantum | Custom VM / opcodes | Compiles to a custom opcode set; hard-gated and verified in real Luau | A dump yields opcodes, not source; requires reversing the custom VM |
Choosing a tier
- Pick a source tier (Standard through Hyper) when you want fast, behavior-preserving protection and accept that a determined attacker could eventually dump the source. Hyper is the strongest of these.
- Pick Quantum when protecting your source against the dump attack matters most and you want the highest bar Quark offers. Remember it may fall back to Hyper if your script uses a construct it cannot guarantee, so a Quantum publish is always at least as protected as Hyper.
- Whatever tier you choose, the surrounding protections are the same: the real source is never in a public URL, delivery is gated by key and HWID validation, and executions are logged server-side.
Publishing with a tier
You select the tier when you publish a key system from the software. Publishing obfuscates your source at the chosen tier and returns the raw loader URL that buyers paste into their executor. The buyer's loader looks like this:
script_key = "THEIR-LICENSE-KEY"
loadstring(game:HttpGet("https://quarkexploits.com/raw/ID.lua"))()The stub aborts if script_key is missing. When it runs, it sends the key and HWID to the server, the server validates them (binding the HWID on first run and rejecting a different HWID to prevent key sharing), and only then returns the obfuscated script for that tier. A Discord webhook fires server-side, so the webhook URL is never in code the buyer can see.
Deobfuscation
Deobfuscation is staff and owner only. There is no self-serve way to reverse a Quark obfuscated output. If you need an obfuscated script inspected or recovered, that is handled by staff, not through a public tool.
If you have questions about which tier fits your script, or you hit a Quantum fallback and want to understand why, ask in the community Discord at discord.gg/AvfJCzRgUz.