// Why developers choose Opaquer

Real protection,
explained clearly

Most obfuscators are black boxes. Opaquer is not. Every technique is documented with real before/after decompiled output so you can see exactly what changes - and what stays the same - when you protect your .NET assembly.

⬇ Download Free Basic Compare plans →
Reason 01 Code Protection

Real protection,
explained clearly

No black box. Every technique Opaquer uses is documented with before/after examples so you know exactly what's happening to your code - and you can verify the results yourself in any decompiler.

Name Obfuscation

All Editions · Free

Renames every identifier in your assembly - classes, methods, fields, properties, events - so decompiled output is completely unreadable. Your application runs identically because the .NET runtime resolves members by internal token, not by name. Two naming modes available: Non-Standard Characters (default) and Non-Displayable Characters (non-recompilable IL).

ILSpy - Before obfuscation Original
Decompiled .NET code before obfuscation - readable C# with real class and method names visible
ILSpy - After: Non-Displayable Characters Protected
Decompiled .NET code after obfuscation using Non-Displayable Characters mode - identifiers replaced with non-recompilable tokens
Left: Original assembly - class names, method names, and field names are fully visible in any decompiler.  ·  Right (Settings → Naming Rules → Non-Displayable Characters): Names are replaced with characters that are syntactically illegal in C#, VB.NET, and IL itself. Even if an attacker extracts this IL, they cannot reassemble it into working code.
ILSpy - After: Non-Standard Characters (default) Protected
Decompiled .NET code after obfuscation using Non-Standard Characters mode - identifiers replaced with short meaningless tokens
Settings → Naming Rules → Non-Standard Characters (default): Names are replaced with short random tokens - readable by a decompiler but completely meaningless. Faster to apply; the preferred mode for most projects.

Control Flow Obfuscation

Lightweight: All Editions · High-Intensity: Enterprise

Restructures method logic at the IL level - inserting opaque predicates, fake conditional branches, and non-linear jump patterns - so static analysis and decompilers cannot reconstruct your original code paths. Choose your tradeoff:

⚡

Lightweight

Moderate IL restructuring with negligible runtime overhead. Decompiler output is unreadable. Available in every edition including free Basic. The right choice for most commercial .NET applications.

🔒

High-Intensity

Maximum IL transformation, paired with cloud code virtualization (Enterprise). Critical method fragments execute inside a secure VM - completely invisible to static analysis. Adds a small runtime overhead on virtualized methods.

String Encryption

All Editions · Free

Encrypts every string literal in your assembly - API keys, connection strings, SQL queries, internal endpoints, license logic - at build time. Strings are decrypted only at runtime, so static analysis tools see nothing but opaque byte arrays. Supports AES-256, 3DES, and SHA-256 hashing. An optional separate native DLL isolates the decryption engine entirely from the managed assembly.

Before: string literals visible in assembly
1// What a decompiler sees - before protection
2private void Connect()
3{
4 string apiKey = "sk_live_4Xp2r9mQ...";
5 string conn = "Server=prod-db;Password=s3cr3t";
6 string endpoint = "https://internal-api.corp/v2";
7}
After: strings encrypted - decompiler sees byte arrays
1// What a decompiler sees - after Opaquer string encryption
2private void ?ÿ₁()
3{
4 string ?₂ÿ = ?₃ÿ.Decrypt(new byte[] { 0xA3, 0x7F, 0xC2, ... });
5 string ?₄ÿ = ?₃ÿ.Decrypt(new byte[] { 0xB9, 0x2E, 0x11, ... });
6 string ?₅ÿ = ?₃ÿ.Decrypt(new byte[] { 0x5D, 0xF0, 0x88, ... });
7}
Reason 02 CI/CD & Automation

Runs where
you build

Configure your obfuscation rules once. Then protect every build automatically - or manually, when you need to. Opaquer fits both workflows without forcing you to choose.

🖥️

GUI for Configuration

Load any .NET DLL or EXE. Browse its full structure in a member tree. Check, uncheck, and configure protection at the assembly, class, or individual-member level. Save as a named profile. Ideal for first-time setup and one-off protection runs.

⚙️

CLI for Automation

Pass a saved settings profile or inline flags to Opaquer.exe from any script. Works as a Visual Studio post-build event, Azure DevOps task, GitHub Actions step, or any scheduled batch job. Available in Pro and Enterprise.

azure-pipelines.yml - post-build obfuscation (Pro / Enterprise CLI)
1# Runs after MSBuild compiles the Release build
2- task: CmdLine@2
3 displayName: 'Obfuscate with Opaquer'
4 condition: eq(variables['BuildConfiguration'], 'Release')
5 inputs:
6 script: |
7 "C:\RustemSoft\Opaquer\Opaquer.exe" ^
8 -SOURCE="$(TargetPath)" ^
9 -OUTPUT="$(TargetPath)" ^
10 -KEY="$(ProjectDir)Signing.snk" ^
11 -ALLPRIVATE -CONCEALSTRINGS -FLOW
Reason 03 Transparent Pricing

Pricing you can see
before you talk to anyone

No "contact sales" wall. No hidden quote process. Every tier, every included feature, and every price is listed publicly. Pick the one that fits, and check out - no sales call required.

Basic
$0
Free forever · Single PC
  • ✔ Name obfuscation
  • ✔ String encryption
  • ✔ Lightweight control flow
  • ✔ WPF / BAML protection
  • ✔ Digital watermarking
  • - Command-line interface
  • - Team deployment
Download Free
Most Popular
Pro
$189.99
One-time · Lifetime license
  • ✔ Everything in Basic
  • ✔ Command-line interface
  • ✔ CI/CD pipeline integration
  • ✔ Private Keys Depot
  • - Team deployment
  • - High-intensity control flow
  • - Offline build server
Buy Pro
Enterprise
$489.99
One-time · Lifetime license
  • ✔ Everything in Pro
  • ✔ Team deployment
  • ✔ High-intensity control flow
  • ✔ Cloud code virtualization
  • ✔ Offline build server
  • ✔ Priority support
Buy Enterprise

One-time payment. No subscriptions. No per-seat royalties. No annual renewal. Full plan comparison →

Reason 04 No-Risk Start

A straightforward trial

Download the free Basic version and test real protection on a real project. Not a demo mode. Not a time-limited evaluation. A fully functional free edition you can use indefinitely.

// What Basic actually gives you

Real protection. No catch.

The Basic edition is not a crippled demo designed to frustrate you into upgrading. Every obfuscation algorithm ships in full. The three excluded features are operational - not protection-related.

  • ✔ All obfuscation algorithms - name, string, control flow, WPF/BAML, watermarking
  • ✔ .NET 8, .NET 9, .NET 10 support
  • ✔ No time limit · No project limit · No watermark on output
  • ✘ No command-line interface (GUI only)
  • ✘ Single-PC install - not for team deployment
  • ✘ Requires internet connection (no offline build server)
⬇ Download Free Read the docs
FAQ Common Questions

Questions developers ask
before choosing

If you're evaluating Opaquer against other tools, these are the questions that come up most.

What makes Opaquer different from other .NET obfuscators?
Most competing tools are black boxes - you feed them an assembly and get a protected one back, with no insight into what changed or why. Opaquer documents every technique with real decompiled before/after examples so you can verify results yourself in ILSpy or dotPeek. It also combines a GUI for manual workflows with a full CLI for CI/CD automation, offers fully public pricing across three tiers (Basic free, Pro $189.99, Enterprise $489.99), and provides a genuinely free Basic edition with no feature-crippled limitations on the obfuscation algorithms themselves.
What is the difference between Non-Displayable and Non-Standard Characters naming modes?
Non-Standard Characters (default) replaces identifiers with short random sequences that are valid in .NET metadata but meaningless. A decompiler can read the token; it just has no idea what it means. Non-Displayable Characters replaces identifiers with characters that are syntactically illegal in C#, VB.NET, and IL itself. Even if an attacker extracts the obfuscated IL, they cannot reassemble it - the names cannot be represented in any source language. Non-Displayable is the stronger choice; Non-Standard is faster to apply and has wider compatibility.
Can I integrate Opaquer into Azure DevOps or GitHub Actions?
Yes, with Pro or Enterprise. Configure your obfuscation settings in the GUI, save a named profile, then invoke Opaquer.exe MyProfile - or pass full flags inline - from a pipeline YAML task or post-build script. The obfuscated assembly overwrites the original before your artifact is published, so the rest of the pipeline treats it as a normal build output. See the documentation for a complete Azure DevOps YAML sample. The Basic edition is GUI-only and does not include the CLI.
Will obfuscation break my application?
Opaquer's transformations preserve runtime semantics exactly - your application executes identically before and after protection. The one common exception is reflection: if your code calls Type.GetType("MyNamespace.MyClass") or Type.GetMethod("MyMethod"), those strings reference identifiers by name. Since obfuscation renames those identifiers, the runtime lookup will fail unless you exclude those specific members. Opaquer's GUI shows every member with an individual checkbox for exclusion. After obfuscation, an XML rename map lets you decode obfuscated stack traces during debugging.
Is the free Basic edition really usable for a commercial product?
Yes. There is no restriction on the type of project you protect - open source, freeware, and commercial software are all permitted under the Basic license. The key constraint is operational: a Basic license activates on one PC and cannot be shared simultaneously across a development team. If multiple developers need to run Opaquer, or if you want automated obfuscation on a shared build server, you need Enterprise. If you're a solo developer obfuscating manually before each release, Basic covers you completely.
Does Opaquer support .NET 8, .NET 9, and .NET 10?
Yes. Opaquer supports all .NET versions: Framework 1.0–4.8, .NET Core, and .NET 5, 6, 7, 8, 9, and 10. It protects console apps, WPF and WinForms desktop applications, class libraries, and any DLL or EXE compiled to a framework-dependent deployment. Opaquer itself requires .NET 10 installed on the machine running the obfuscation tool; the assemblies it protects can target any supported version.
Can automated tools like de4dot unpack Opaquer's protection?
No. Tools like de4dot work by recognizing fixed signatures left behind by known obfuscation routines. Opaquer's control flow transformation generates a different instruction pattern on every build, so there are no static signatures for an automated unpacker to target. High-Intensity control flow (Enterprise) pairs this with cloud code virtualization, where the most sensitive method fragments execute inside a secure VM - completely absent from the assembly itself and invisible to any static analysis tool.
Do I need to change my source code to use Opaquer?
No. Opaquer operates on compiled assemblies - your DLL or EXE - not on source code. Your project, solution, and build pipeline stay exactly as they are. The only integration point is the output of your build: feed the compiled assembly to Opaquer, and it produces a protected version. If you use the CLI (Pro/Enterprise), this happens automatically in your pipeline without any source changes. You can optionally add [System.Reflection.Obfuscation] attributes to your code to give Opaquer member-level hints, but this is never required.

See it on your own code

Download the free Basic edition, load your assembly, and check the result in ILSpy yourself. No time limit. No registration required.

⬇ Download Free Basic Read Documentation Compare Plans