FAQ

Transforming Python code so it still runs but is much harder to read and understand. PyArmor replaces each module with a small stub and an encrypted payload, which its runtime decodes in memory when the module is imported.

Python usually ships as readable source. If you deliver software to customers or partners who run it on their own machines, obfuscation makes it much harder for them to read, copy or modify your logic.

It uses encryption (AES, RSA) internally, but the result is obfuscation, not secrecy in the cryptographic sense. To run, the code must be decoded, and what is needed for that ships with the app inside the runtime. Treat it as raising the reverse-engineering effort, not as encrypted storage.

With enough time, skill and access, the behaviour of any program that runs on a machine you do not control can be studied. Obfuscation makes that much more expensive. It does not make it impossible, especially for code running in an environment the attacker controls.

No. A secret the code uses must exist in plain form in memory when it is used, and often appears in requests, logs and error reports. The workshop shows constants being read from a protected module at runtime.

Never. Keep secrets out of code entirely, protected or not. Inject them at runtime from a secrets manager, scope them narrowly, and rotate them.

No. Anyone with the image can list its files, read its layers and inspect its environment variables. A multi-stage build can keep source out of the final image, but the image itself is fully readable to whoever has it.

No. Access control decides who can reach your servers, containers and data. Obfuscation only affects how readable your shipped code is.

No. They solve different problems: a secrets manager stores, scopes, audits and rotates credentials. Obfuscation does none of that.

Yes, when you ship code to environments you do not control and the logic is worth protecting, with a proper license (the trial is not for commercial products that earn real money). It adds little for code that only runs on your own servers, where access control matters far more.

Then they control the execution environment. They can run the app, call its functions, read environment variables and files, watch inputs and outputs, and inspect the process. Obfuscation is not the boundary at that point: access control, isolation, monitoring and secrets management are.

PyArmor 9.2.7 (trial) on Python 3.12. Commands such as pyarmor obfuscate or pyarmor pack belong to PyArmor 7 and earlier; the current command is pyarmor gen.