---
title: "Discussion on \"String encryption is not enough: attackers dump your JavaScript at runtime\" | Hashnode"
description: "Discussion on \"String encryption is not enough: attackers dump your JavaScript at runtime\". String encryption hides literals in the file, not at runtime. This article explains how a runtime dump undoes string tables, why control-flow and VM protection raise the cost of finding when those strings are used, and why secrets still do not belong in client JavaScript."
url: "https://hashnode.com/posts/string-encryption-is-not-enough-attackers-dump-your-javascript-at-runtime/6af7b8829ccc8cab3884cf54"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [String encryption is not enough: attackers dump your JavaScript at runtime](https://veilvm.hashnode.dev/string-encryption-is-not-enough-attackers-dump-your-javascript-at-runtime?utm_source=hashnode&utm_medium=feed)

String encryption hides literals in the file, not at runtime. This article explains how a runtime dump undoes string tables, why control-flow and VM protection raise the cost of finding when those strings are used, and why secrets still do not belong in client JavaScript.

21h ago · 7 min read · veilvm.hashnode.dev  
Read the article

-   [#javascript](https://hashnode.com/tag/javascript)
-   [#web-security](https://hashnode.com/tag/web-security)
-   [#security](https://hashnode.com/tag/security)
-   [#obfuscation](https://hashnode.com/tag/obfuscation)

## Written by

[VEILVM](https://hashnode.com/@veilvm)

@veilvm

  
[View profile](https://hashnode.com/@veilvm)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.