FAQ

Protection

Is my code "unbreakable" after this?

No — and anyone who says their Java obfuscator makes code unbreakable is lying. Compiled software can always be reversed with enough effort. What Lock Master does is push that effort past the point where it's worth it: strings encrypted, structure rewritten, classes optionally sealed, and the whole thing hostile to analysis at rest and while running.

What actually protects the most?

String encryption and class encryption (classGuard) are the heaviest hitters — with classes sealed there's no loadable bytecode on disk to decompile. Flow obfuscation makes whatever is readable unpleasant to follow.

Will it stop a decompiler?

With strings gone and flow rewritten, decompilers produce garbage or bail out on the hard methods. With classGuard on, they have nothing to open at all.

Is my source code uploaded or stored?

You upload a compiled JAR, not source. It's processed and the result handed back; the transformation is static analysis and your classes are never executed on our side.

Using it

Do I need to understand bytecode?

No. Pick a preset, turn on string encryption and rename, add a couple of keep rules for your main class and public API, and you're protected. The depth is there if you want it.

Can I use one key across my laptop and CI?

Give each machine its own seat key — it's cleaner and you can rotate or revoke one without touching the others. Your plan sets how many seats you get.

What's a token again?

Tokens pay for obfuscation jobs, metered by build size: a job up to 10 MB costs 1 token, then +1 per extra 10 MB (1 + ceil((sizeMB − 10) / 10)). Plans grant monthly tokens (use-it-or-lose-it); token packs are one-off and never expire. An empty config is rejected before it can spend anything.

Can I keep the same obfuscated names across releases?

Yes — pass --mapping rymga.map to the CLI. It reuses the previous build's names for unchanged symbols and writes the updated map back to the same file, so a renamed public API stays stable version to version (like ProGuard's applymapping). Commit that file with each release. A seed alone only makes an identical input reproducible; for names that survive code changes use --mapping, or keep the API unrenamed.

Troubleshooting

My plugin/app broke after obfuscation.

Almost always a reflection or by-name lookup whose target got renamed. Add those classes, packages or members to keep. Common culprits: your plugin main class, event listeners registered by name, config-mapped classes, and anything you Class.forName or look up reflectively.

My plugin won't load with classGuard on.

In PLUGIN mode, set pluginMainClass to your main class's internal name and keep rename on — and don't add the main to keep or excludeClasses. Lock Master renames and encrypts it and ships a cleartext stub under your plugin.yml name. Always test the sealed build on a real server before shipping.

It says "config enables no technique".

An empty (or one with everything off) is rejected on purpose — it would do nothing and waste a token. Enable at least one technique.

The build got much bigger.

Flow obfuscation adds size — roughly 1.4× (light) to 3.4× (aggressive). Drop to a lighter preset if size matters more than depth.

Something timing-sensitive misbehaves.

Rare, but if you have real-time thread coordination, keep timingSafeIndy on (the default). See flow.

Account & billing

How do I get access?

It's invite-only: sign in with Google, request access, wait for approval. See Access & accounts.

How do I cancel?

From billing, open Manage subscription (Stripe). You keep access until the end of the paid period.

Do unused monthly tokens roll over?

No — monthly tokens reset each cycle. Token packs never expire and are spent only after the monthly ones run out.