# Compile your app into a protected executable
$ nebula src/index.js -o myapp.exe --encrypt --obfuscate
✓ Bundling modules ................ 0.6s
✓ Obfuscation .................. 1.2s
✓ Encryption ................... 0.1s
✓ Native packaging ............. 2.1s
Done! myapp.exe — ready to ship
# Compile a protected CLI tool $ nebula src/index.js -o mytool.exe --encrypt --obfuscate # Add a 90-day expiration (great for trials) $ nebula src/index.js -o mytool.exe --encrypt --expires 90d # Use a protection preset for one-click security $ nebula src/index.js -o mytool.exe --protect strong
# Build a native desktop app with WebView $ nebula src/app.js -o myapp.exe --gui --encrypt # Customize the window $ nebula src/app.js -o myapp.exe --gui \ --win-width 1400 --win-height 900 \ --name "My App" # Frameless window (custom titlebar) $ nebula src/app.js --gui --no-win-decorations
# Build for Windows $ nebula src/index.js -o app.exe -t win # Build for Linux $ nebula src/index.js -o app -t linux # Build for macOS (Intel + Apple Silicon) $ nebula src/index.js -o app -t macos -a arm64 # Same source code, three platforms, zero changes
days day
hours hour
minutes minute
seconds second
No. The compiled executable is completely self-contained.
It includes everything needed to run your application. Your end users just double-click the file — no Node.js, no npm, no dependencies.
Yes — distribution is always a single .exe. The runtime behavior depends on the build mode:
In both cases, your application code is never written to disk in plaintext. It stays encrypted inside the binary and is decrypted only in memory at runtime. That's the protection promise — not "no temp files ever".
For comparison, PyInstaller, pkg, and most Node/Python packagers extract their full runtime plus your source code to temp on every launch.
Nebula supports Node.js 18 and above. All npm packages that work in a standard Node.js environment are compatible, including native addons. The bundler resolves all dependencies automatically.
GUI mode wraps your Node.js application in a native OS window with a built-in WebView. Your app serves HTML/CSS/JS locally, and the WebView renders it — similar to Electron, but using each platform's native web engine instead of shipping a full Chromium browser. The result is roughly 60 MB instead of Electron's 200+ MB.
Engines per platform:
Yes. Use the -t flag to target any platform: -t win, -t linux, -t macos.
Nebula ships with pre-built launchers for all supported platforms — no additional toolchains or compilers needed. Build for Windows, macOS and Linux from a single machine.
Nebula uses multiple independent protection layers working together: encryption, obfuscation, code virtualization, and runtime integrity checks.
Each build produces a structurally unique binary with unique cryptographic keys. Your source code never exists as plaintext on disk and is processed in protected memory at runtime.
Presets are curated protection profiles that bundle the right settings for common scenarios. Choose a level that fits your needs — from fast builds with essential protection to maximum security with all defenses active. You can also fine-tune individual settings for full control.
Startup has a small overhead for decryption and integrity checks. After that, your code runs at full native speed.
Code virtualization adds negligible overhead per call. You can apply it selectively to only your most sensitive functions while keeping the rest at maximum performance.
Yes. Create a nebula.config.json file in your project root with all your build settings. Nebula automatically detects it.
CLI flags always override config file values, so you can use the config as a baseline and tweak individual options per build. Run nebula --help for the full list of options.
Bytenode is a good first step: it converts your .js files into V8 bytecode and prevents them from being read directly. The problem is that V8 bytecode is a public, well-documented standard—there are open-source tools that can extract it from the binary and reconstruct a large portion of its logic.
Nebula starts from that same idea—removing the JavaScript source from the final binary—but adds additional independent layers on top: a custom virtual machine with a non-standard instruction set, asset encryption, virtualization of critical sections, and packaging into a single native executable. Every layer that Bytenode lacks is one more layer that a reverse engineer must dismantle.
If all you need is to hide the code from casual observers, bytenode is free and works just fine. If you distribute commercial software to customers who might be motivated to extract its logic, you need more.
