OrvexSecurity — 16 protection layers

No one reverses what no one understands.

What We Do

Orvex is an obfuscation service for securing your Lua scripts. We use a multi-layer protection pipeline — if an attacker defeats one layer, many more remain. No obfuscation is unbreakable, but Orvex is built to make reverse engineering costly enough that it stops being worth it for most attackers.

16-layer pipelineNon-deterministic output
Processing time
Free< 1sPro~1–2sPremium~1–3s
Approximate — scales with script size. Small scripts are near-instant; large scripts with full VM protection take longer.
InputOutput
-- Original Lua script
local function calculateDamage(base, multiplier)
  local crit = math.random() > 0.85
  local dmg = base * multiplier
  if crit then dmg = dmg * 2.5 end
  return math.floor(dmg)
end

local player = {
  name = "Hero",
  health = 100,
  attack = 45
}
Click "Obfuscate Demo" to compare before / after

Drag the slider to compare readable source with protected output

Why Orvex

Protection that never looks the same twice

Orvex doesn't just rename your variables or encrypt your strings. Every build can generate a different internal representation — VM, opcodes, dispatch, bytecode encoding and generation parameters all shift, so the output stays hard to predict.

Metamorphic VM

Each build generates a different internal VM layout. Opcode identifiers, their structure, and the dispatch engine can all change from one build to the next — a tool built around one exact layout won't map cleanly onto the next.

Protected bytecode

Bytecode is transformed and encoded before the VM ever executes it, with build-dependent masking and encoding parameters that shift across generations.

Variable dispatch

The dispatch engine isn't locked to a single structure — handler layout, ordering, and internal comparison logic can vary by build.

Control-flow disruption

Opaque predicates, decoy branches, dead code and virtual dispatch reshape the program's structure — the output stops being a readable mirror of the original.

VMOpcodesDispatchEncodingJunk / decoysBuild parameters

Two builds from the same script aren't guaranteed to be identical — the differences hold even after abstracting away names and numeric values. It's not just variable_A → variable_B. The internal representation itself evolves.

Everything you need

Everything you need to protect your work

From control flow obfuscation to VM bytecode injection — every layer adds cost to reverse engineering.

A multi-stage Lua obfuscation engine designed to increase the time and complexity required for reverse engineering and static analysis.

No obfuscation can guarantee absolute protection. Orvex adds multiple independent analysis barriers to raise the bar for attackers.

Premium

Full Second Protection Pass

Premium runs your VM-protected script through the entire pipeline again — fresh identifier renaming, number encoding and string encryption — then adds control-flow flattening, virtual dispatch on native calls, and pointer indirection on top. More independent layers to strip before anything is readable.

Premium

Metamorphic VM Dispatch

The VM's opcode ids, dispatch order and even which fused instruction forms exist are reshuffled independently on every single compile. A devirtualizer built against one output doesn't transfer to the next — there's no fixed opcode table to reverse.

Pro

VM Anti-Tamper Layer

A fast custom Lua VM: crypto-seeded opcode map and per-position bytecode masking, backed by a runtime check that catches a debugger before it reaches your code — even one that spoofs debug.gethook or redefines error() to hide itself.

Free

Mini VM

Even on the free tier, core logic is compiled to a compact custom bytecode and run by a lightweight interpreter — genuine virtual-machine protection, not just renaming, and near-instant to execute.

Pro

Dynamic Load Protection

Static string arguments passed to load() and loadstring() are detected and recursively obfuscated too — not shipped in clear text like every other obfuscator leaves it. Your dynamically-loaded logic gets the same protection as the rest.

Pro

Live Anti-Hook & Anti-Debug

Before a protected function runs, the runtime checks whether a debug hook is already attached — and keeps polling afterward. Attempts to hide a hook by monkey-patching debug.gethook, type() or error() are caught rather than trusted, and a detected debugger corrupts execution instead of ever handing back real data.

Free

Non-Deterministic Output

Identical source never produces the same output twice. Identifiers are redrawn from a fresh pool of natural-looking names and the whole structure is rebuilt on every compile, so signature-based detection, pattern-based renaming and script-diffing tools get nothing consistent to lock onto.

Free

Control Flow Flattening

All branching logic is collapsed into dispatch loops driven by opaque predicates. The original control graph is unrecoverable — decompilers produce unreadable, misleading output.

Free

9-Mode String & Number Encryption

Every string literal and constant is encrypted with one of 9 independent cipher modes, each value carrying its own randomly-generated key. Static string extraction returns nothing useful, and decoding happens byte-by-byte into a table instead of building the plaintext up in one variable, so a mid-execution memory read never catches more than a single decoded character at a time.

Pro

REST API

Integrate obfuscation directly into your build pipeline. Submit scripts and retrieve protected output programmatically — single jobs or batched.

Pro

Virtualized Strings

On VM-protected builds, string literals never decode through a visible Lua function. They rebuild inside the virtual machine itself through a dedicated instruction, each reference scrambled by a per-build selector and buried among decoy records, with the encrypted pool held outside the constant table. Even after devirtualization there's no decoder to lift and nothing ties an instruction back to its original text.

Free

Analytics Dashboard

Track every obfuscation job, monitor quota usage, and review your full submission history from one place.

Pricing

Simple, transparent pricing

No hidden fees. Cancel anytime. Start free — upgrade when you need more.

Free
Free
30 / month

Try Orvex with no commitment. Covers personal scripts and small experiments.

Free

  • 30 obfuscations per month
  • 16-layer protection pipeline
  • Control flow & dead-code hardening
  • Bytecode VM virtualization
  • Encrypted literals (strings & numbers)
  • Unique output every run
  • 6 Lua runtime targets
  • History (7 days)
  • Advanced protection options
  • Archive batch obfuscation (.zip)
  • REST API access
  • Integrity verification header
  • load() / loadstring() obfuscation
  • Second protection pass
  • Priority support
Most Popular
Paid
Pro
1 000 / month

For developers needing API integration and full control of production scripts.

$15/mo

  • 1 000 obfuscations per month
  • 16-layer protection pipeline
  • Control flow & dead-code hardening
  • Bytecode VM virtualization
  • Encrypted literals (strings & numbers)
  • Unique output every run
  • 6 Lua runtime targets
  • History (90 days)
  • Advanced protection options
  • Archive batch obfuscation (.zip)
  • REST API access
  • Integrity verification header
  • load() / loadstring() obfuscation
  • Second protection pass
  • Priority support
Paid
Premium
5 000 / month

Maximum hardening with a second protection pass and unlimited history.

$35/mo

  • 5 000 obfuscations per month
  • 16-layer protection pipeline
  • Control flow & dead-code hardening
  • Bytecode VM virtualization
  • Encrypted literals (strings & numbers)
  • Unique output every run
  • 6 Lua runtime targets
  • Unlimited history
  • Advanced protection options
  • Archive batch obfuscation (.zip)
  • REST API access
  • Integrity verification header
  • load() / loadstring() obfuscation
  • Second protection pass
  • Priority support
Paid
Enterprise
Unlimited

Custom volume, priority support, and tailored terms for teams and platforms.

Custom

  • Unlimited obfuscations
  • 16-layer protection pipeline
  • Control flow & dead-code hardening
  • Bytecode VM virtualization
  • Encrypted literals (strings & numbers)
  • Unique output every run
  • 6 Lua runtime targets
  • Unlimited history
  • Advanced protection options
  • Archive batch obfuscation (.zip)
  • REST API access
  • Integrity verification header
  • load() / loadstring() obfuscation
  • Second protection pass
  • Priority support
Tested & verified

Tested. Fixed. Improved.

Orvex is developed with a test-first approach. Thousands of builds have been used to catch compatibility issues, edge cases and regressions before they reach you.

998/999

When something works on 998 out of 999 cases, the 999th is still a bug to fix. Every issue found becomes an opportunity to harden the engine.

We'd rather explain what Orvex actually does than promise protection that "can't be broken." No obfuscation is unbreakable — Orvex is built to make the effort not worth it.

Recent updates

v14.1Latest
  • Output up to 10× lighter for some content
  • Optimized runtime decoding
  • Extended VM coverage
  • Better handling of large scripts
  • Edge-case fixes
  • Mini VM introduced — a first layer of virtualization, free
v14
  • Hardened virtualization core
  • Dynamic-load (load / loadstring) protection
  • Improved reliability
  • New protection layer
FAQ

Frequently Asked Questions

Still have questions? Contact us — we'll respond within 24h.

Your account data and usage quotas are protected with industry-standard encryption. Sensitive information like API keys and billing data are never stored in plain text, ensuring your account remains secure even in the unlikely event of a data breach.

Both rely on a custom per-build VM, so there's real overlap in approach. Where Orvex stands apart: it natively targets FiveM and GTA V alongside Roblox, Luau, LuaJIT and Lua 5.1–5.4; it also protects code inside load() and loadstring() calls, which most obfuscators leave in clear text; and its output is regenerated with a different internal structure on every build. Pricing is flat monthly quotas — no tokens, no per-obfuscation charges. We won't claim any obfuscator is unbreakable, but Orvex is built to make automated deobfuscation impractical and is actively maintained.

No obfuscation is permanent — given enough time and expertise, a determined attacker can reverse anything. What Orvex does is raise the cost significantly: the custom per-build VM has no public specification, every build is structurally different, and multiple independent layers must each be broken before the original logic becomes readable. The goal is to make the effort not worth it in practice.

No. Orvex performs semantic-preserving transformations — the obfuscated script behaves identically to the original. We run automated correctness tests on every output before delivery.

API access starts with the Pro plan. Free users can obfuscate through the web dashboard only.

Enterprise customers with an approved use case may obfuscate scripts on behalf of their end-users. This is not permitted on any other plan to prevent abuse.

Orvex fully supports Lua 5.1, 5.2, 5.3, 5.4, and LuaJIT. Roblox Luau is also supported with dedicated settings.