What can I try without installing anything?
The online tool gives you a before-and-after preview in the browser with no account and no install. It is deliberately scoped to samples rather than whole projects: uploads are capped at sixteen kilobytes and the protected sample it returns is capped at two kilobytes, and the endpoint is rate limited. Options that need extra values or that only make sense during desktop processing are skipped in the preview. It is the right way to see what the transforms do to code you recognise, and the wrong way to protect a real build.
What is the difference between the online tool and the desktop application?
Scale and workflow rather than a different engine. The desktop application handles whole-project batches, keeps a project file so a configuration is reused across releases, and processes mixed files where script sits inside markup. The online tool is a preview surface. Teams generally evaluate in the browser, then move to the desktop application or the command line package once they are protecting something real.
Do I have to send my source code to a server?
Not on every path, and this is worth being precise about because it is the question buyers ask most. There are workflows where the source body stays on the machine: a local mode in the Windows application and a local flag in the command line package. Those still perform an online entitlement check, so the machine needs connectivity, but the check carries no source. Virtual machine protection is the exception and remains a hosted step by design. The security and processing documentation states the boundary in detail.
How much does protection change my file size and speed?
It depends entirely on which transforms you enable, which is why the tour shows the levels separately rather than quoting a single number. Renaming alone is close to free and often smaller after minification. Control-flow flattening, string tables and virtualisation all trade size and startup time for reversal cost. The honest way to decide is to measure your own bundle at two or three settings on a representative device rather than accepting anybody's headline figure.
Which protection level should I start with?
Start lower than you expect to finish. Enable renaming and the string handling first, confirm your test suite passes against the protected artifact, then add heavier transforms one at a time so that if something breaks you know which option caused it. Jumping straight to the maximum setting on a large application is the most common way teams end up with a failure they cannot attribute.
Does the protected code still run everywhere my original did?
In the normal arrangement yes, because the engine preserves the language level it reads rather than transpiling. There is no ECMAScript target setting because no such transformation happens, and the runtime guards it injects are written in conservative syntax. Your browser support is decided by your transpiler configuration, and the way to confirm it is to run your existing tests against the protected build on the oldest configuration you support.
Can I automate this in a build pipeline?
Yes, and that is where most production use ends up. There is a command line runner and a package for Node-based builds with plugins for the common bundlers, so protection becomes a build step rather than a manual action somebody remembers to perform. The important sequencing rule is that everything which works by reading code, meaning linters, scanners, coverage and extraction tooling, runs before the protection step.
How do I debug a problem in a protected build?
By keeping the mapping information the build produces and symbolicating stack traces against it, rather than by reading the protected file. That is the same arrangement teams already use for minified production code, and it means a report from a user can still be turned into a location in your source. Rehearse it once before you need it, because discovering the workflow during an incident is expensive.