# I'm Shocked! Why Are Plugins Decrypted on Install?

**URL:** <https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629>\
**Category:** Photoshop\
**Created:** [September 16, 2021, 2:04pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629 "2021-09-16T14:04:30Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 2:04pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/1 "2021-09-16T14:04:30Z")

</div>

I just realized that UXP plugins are decrypted and installed as plain text on the user’s computer. Seeing the ccx installer file encyrpted was one of my initial motivations to rewrite my old border scripts for the UXP framework. I’ve poured months, literally thousands of hours into developing a feature-rich plugin and now find that all of my code is just sitting there for anyone that buys the plugin to see.

I know that it’s not really possible to completely protect scripting languages from being viewed with encryption alone, but really, is it necessary to simply leave this fully visible to anyone that wants to take or look, or even steal? Are there any plans to protect the intellectual property of the hordes of developers pouring their hearts and souls into these plugins?

---

<div class="post-metadata">

**Author:** ![Pierre\_G](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/pierre_g/32/971_2.png) [@Pierre\_G](https://forums.creativeclouddeveloper.com/u/Pierre_G)\
**Post date:** [September 16, 2021, 2:16pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/2 "2021-09-16T14:16:47Z")

</div>

You could obfuscate your JS 😉

---

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 2:17pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/3 "2021-09-16T14:17:50Z")

</div>

Sure, but I didn’t know it was not encrypted until a few minutes ago. Aargh!!

---

<div class="post-metadata">

**Author:** ![Karmalakas](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/karmalakas/32/1048_2.png) [@Karmalakas](https://forums.creativeclouddeveloper.com/u/Karmalakas)\
**Post date:** [September 16, 2021, 2:32pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/4 "2021-09-16T14:32:41Z")

</div>

What do you mean by `decrypted`? It was never a secret, that CCX is just a simple ZIP archive with all your code inside

---

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 2:46pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/5 "2021-09-16T14:46:47Z")

</div>

For sure, it’s my oversight, but I was reassured when I opened the installer and found a binary file. I thought that Adobe had done a good job to protect the contents of the plugin. Besides, I never said it was a secret. It was just not something that I thought to check into further based on the binary installer.

---

<div class="post-metadata">

**Author:** ![Jarda](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/jarda/32/1909_2.png) [@Jarda](https://forums.creativeclouddeveloper.com/u/Jarda)\
**Post date:** [September 16, 2021, 2:47pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/6 "2021-09-16T14:47:06Z")

</div>

It never was encrypted in the first place.

---

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 2:48pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/7 "2021-09-16T14:48:47Z")

</div>

OK, old hat developers. I know NOW that it was never encrypted, but it was not obvious that it was not. Does no one agree that more could be done to protect the contents of the files?

Even better, what are people using to obfuscate your files? If you are already using something that is known to work well with UXP plugins, I’d really appreciate some constructive advice.

---

<div class="post-metadata">

**Author:** ![Jarda](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/jarda/32/1909_2.png) [@Jarda](https://forums.creativeclouddeveloper.com/u/Jarda)\
**Post date:** [September 16, 2021, 2:50pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/8 "2021-09-16T14:50:52Z")

</div>

Proper encryption is on our wishlists for decades. Even JSXBIN is not an encryption. It even preserves variable names.

---

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 2:52pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/9 "2021-09-16T14:52:55Z")

</div>

Yes, I saw that, again though, just tonight, after I found the jsx files sitting all unpacked on my hard drive. Should have looked harder much earlier.

---

<div class="post-metadata">

**Author:** ![Pierre\_G](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/pierre_g/32/971_2.png) [@Pierre\_G](https://forums.creativeclouddeveloper.com/u/Pierre_G)\
**Post date:** [September 16, 2021, 3:00pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/10 "2021-09-16T15:00:57Z")

</div>

Hi, you might want to have a go with this

[https://obfuscator.io/](https://obfuscator.io/)

---

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 3:08pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/11 "2021-09-16T15:08:46Z")

</div>

Thanks! I was just looking at that so your reply gives me confidence to dig deeper.

Have you used this yourself for a UXP plugin? I don’t want to jump in and do something that would cause problems for the review process or anything.

---

<div class="post-metadata">

**Author:** ![Karmalakas](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/karmalakas/32/1048_2.png) [@Karmalakas](https://forums.creativeclouddeveloper.com/u/Karmalakas)\
**Post date:** [September 16, 2021, 3:09pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/12 "2021-09-16T15:09:29Z")

</div>

I use Obfuscator (same @Pierre_G posted) and webpack:

```auto

module.exports = function (env, argv) {

    <...>

    return {
        <...>
        plugins: [

            <...>

            new WebpackObfuscator({
                debugProtection: true,
                disableConsoleOutput: true,
                selfDefending: true,
            }),
            
            <...>

        ]
    };
};

```

Works like a charm

---

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 3:11pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/13 "2021-09-16T15:11:00Z")

</div>

Excellent! Thanks @Karmalakas. I’ll give it a try.

---

<div class="post-metadata">

**Author:** ![Pierre\_G](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/pierre_g/32/971_2.png) [@Pierre\_G](https://forums.creativeclouddeveloper.com/u/Pierre_G)\
**Post date:** [September 16, 2021, 3:21pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/14 "2021-09-16T15:21:21Z")

</div>

I’m using that link for each and every plugin of mine. Plenty of options to adjust. Until it eventually breaks. So you’d want to start and gradually introduce more “scrambling” until… then you know what works for you 🙂

---

<div class="post-metadata">

**Author:** ![MartinBailey](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/martinbailey/32/1416_2.png) [@MartinBailey](https://forums.creativeclouddeveloper.com/u/MartinBailey)\
**Post date:** [September 16, 2021, 3:23pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/15 "2021-09-16T15:23:54Z")

</div>

Great! Thanks @Pierre_G ! I really appreciate the help.

---

<div class="post-metadata">

**Author:** ![Pierre\_G](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/pierre_g/32/971_2.png) [@Pierre\_G](https://forums.creativeclouddeveloper.com/u/Pierre_G)\
**Post date:** [September 16, 2021, 3:34pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/16 "2021-09-16T15:34:58Z")

</div>

You’re most welcome 🙏🏻

---

<div class="post-metadata">

**Author:** ![Jarda](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/jarda/32/1909_2.png) [@Jarda](https://forums.creativeclouddeveloper.com/u/Jarda)\
**Post date:** [September 16, 2021, 3:38pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/17 "2021-09-16T15:38:35Z")

</div>

Same worked for me. I think both plugins passed review in Marketplace.

---

<div class="post-metadata">

**Author:** ![simonhenke](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/simonhenke/32/957_2.png) [@simonhenke](https://forums.creativeclouddeveloper.com/u/simonhenke)\
**Post date:** [September 16, 2021, 6:03pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/18 "2021-09-16T18:03:57Z")

</div>

I was wondering… If you use React and your code gets compiled to plain JS, is there really an easy way to retrieve the original state? Sure, you could steal some individual parts but without seeing the whole picture they’d be out of context and kind of hard to understand, wouldn’t they?

---

<div class="post-metadata">

**Author:** ![Pierre\_G](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/pierre_g/32/971_2.png) [@Pierre\_G](https://forums.creativeclouddeveloper.com/u/Pierre_G)\
**Post date:** [September 16, 2021, 6:24pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/19 "2021-09-16T18:24:29Z")

</div>

That’s correct. Not even sure about reverse-engineering some parts, or one should have a lot of time and energy to dive in 😉

---

<div class="post-metadata">

**Author:** ![simonhenke](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.creativeclouddeveloper.com/simonhenke/32/957_2.png) [@simonhenke](https://forums.creativeclouddeveloper.com/u/simonhenke)\
**Post date:** [September 16, 2021, 7:24pm UTC](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629/20 "2021-09-16T19:24:49Z")

</div>

Sounds fine to me then. I also feel like someone who’d take the time to reverse-engineer that compiled mess could also just write the plugin himself in the first place 🤷‍♂️

[Next page](https://forums.creativeclouddeveloper.com/t/im-shocked-why-are-plugins-decrypted-on-install/3629.md?page=2)