stxdefender
Advanced tools
Python Source Code Encryption Tool - Enterprise-grade protection for your Python source code
STXDefender is the easiest way to obfuscate Python code using AES-256-GCM encryption. AES is a symmetric algorithm which uses the same key for both encryption and decryption (the security of an AES system increases exponentially with key length). There is no impact on the performance of your running application as the decryption process takes place during the import of your module, so encrypted code won't run any slower once loaded from a .pye file compared to loading from a .py or .pyc file.
We support the following Operating System and architecture combinations. Encrypted code will run on ANY other target using the same version of Python. For example, files encrypted in Windows using Python 3.10 will run with Python 3.10 on Linux.
| CPU Architecture | Operating System | Python Architecture | Python Versions |
|---|---|---|---|
| AMD64 | Windows | 64-bit | 3.8 - 3.12 |
| x86_64 | Linux | 64-bit | 3.8 - 3.12 |
| x86_64 | macOS | 64-bit | 3.8 - 3.12 |
| ARM64 | macOS | 64-bit | 3.8 - 3.12 |
| AARCH64 | Linux | 64-bit | 3.8 - 3.12 |
pip install stxdefender
After installation, the stxdefender command will be available globally.
The installation of STXDefender will grant you a trial licence to encrypt files. This trial licence will only allow your script to work for a maximum of 24 hours; after that, it won't be usable. This is so you can test whether our solution is suitable for your needs.
To distribute encrypted code without limitation, you will need to create an account and set up your subscription. Once you have set up the account, you will be able to retrieve your activation token and use it to authorise your installation:
$ stxdefender activate --token 470a7f2e76ac11eb94390242ac130002
STXDEFENDER ACTIVATED
Registration:
- Account Status : Active
- Email Address : hello@example.com
- Account ID : bfa41ccd-9738-33c0-83e9-cfa649c05288
- System ID : 7c9d-6ebb-5490-4e6f
- Valid Until : Sun, Apr 9, 2025 10:59 PM
Without activating your SDK, any encrypted code you create will only be usable for a maximum of 24hrs. Access to our dashboard (via HTTPS) from your system is required so we can validate your account status.
If you want to view your activated licence status, you can use the validate option:
$ stxdefender validate
STXDEFENDER
Registration:
- Account Status : Active
- Email Address : hello@example.com
- Account ID : bfa41ccd-9738-33c0-83e9-cfa649c05288
- System ID : 7c9d-6ebb-5490-4e6f
- Valid Until : Sun, Apr 9, 2025 10:59 PM
$
If your licence is valid, this command will give the Exit Code (EC) of #0 (zero); otherwise, an invalid licence will be indicated by the EC of #1 (one). You should run this command after any automated build tasks to ensure you haven't created code with an unexpected 24-hour limitation.
We have worked hard to ensure that the encryption/decryption process is as simple as possible. Here are a few examples of how it works and how to use the features provided.
First, let's have a look at an example of the encryption process:
$ cat /home/ubuntu/helloworld.py
print("Hello World!")
$
This is a very basic example, but we do not want anyone to get at our source code. We also don't want anyone to run this code after 1 hour so when we encrypt the file we can enforce an expiry time of 1 hour from now with the --ttl option, and we can delete the plaintext .py file after encryption by adding the --remove option.
The command would look like this:
$ stxdefender encrypt --remove --ttl=1h /home/ubuntu/helloworld.py
STXDEFENDER
Processing:
/home/ubuntu/helloworld.py
Encrypted → /home/ubuntu/helloworld.pye
TTL enforced: 1h
Original /home/ubuntu/helloworld.py removed
$
The TTL argument offers the following options: weeks(w), days(d), hours(h), minutes(m), and seconds(s). Usage is for example: --ttl=10s, or --ttl=24m, or --ttl=1d, or just --ttl=3600. This can't be changed after encryption.
The --remove option deletes the original .py file. Make sure you use this so you don't accidentally distribute the plain-text code.
The usual import system can still be used, and you can import encrypted code from within encrypted code, so you don't need to do anything special with your import statements. However, you need to import the stxdefender module before importing encrypted code.
$ cd /home/ubuntu
$ ls
helloworld.pye
$ python3
>>>
>>> import stxdefender
>>> import helloworld
Hello World!
>>> exit()
$
Note: When using encrypted files, you must import stxdefender before importing any encrypted .pye modules. This registers the import hook that handles decryption.
It's easy to use your own encryption password. If you do not set this, we generate unique ones for each file you encrypt. Our passwords are more secure, but should you wish to set your own, these can be set from a command option:
stxdefender encrypt --password=1234abcd mycode.py
or as an Environment variable:
export STXDEFENDER_PASSWORD="1234abcd"
stxdefender encrypt mycode.py
To import the code, you can set an environment variable (as with the encryption process). You can also set these in your code before the import:
$ python3
>>> import stxdefender
>>> from os import environ
>>> environ["STXDEFENDER_PASSWORD"] = "1234abcd"
>>> import mycode
The password is applicable to the next import, so if you want different ones for different files, feel free to encrypt with different values.
You can add a shebang to encrypted .pye files to make them directly executable. The shebang must be the first line of the file, followed by the encrypted content.
Important: Normal Python imports (import module) always require the .pye extension. Files without extension are only recognized when executed directly (via ./script or python script), not when imported.
Here's an example. First, encrypt a file:
$ cat echo.py
print("echo")
print("Name:", __name__)
$ stxdefender encrypt echo.py --remove
$ sed -i '1i#!/usr/bin/env python3' echo.pye
$ chmod +x echo.pye
$ ./echo.pye
echo
Name: __main__
$
On Windows, you can use Python directly:
python echo.pye
PyInstaller scans your plain-text code for import statements so it knows what packages to freeze. When using encrypted code, ensure that STXDefender is included in your dependencies and that you import it before any encrypted modules.
For this example, we have the following project structure:
pyexe.py
lib
└── helloworld.pye
In our pyexe script, we have the following code:
$ cat pyexe.py
import stxdefender
import helloworld
To ensure that PyInstaller includes our encrypted files, we need to tell it where they are with the --add-binary option. So, for the above project, we could use this command:
stxdefender encrypt pyexe.py --remove
pyinstaller --add-binary "lib/helloworld.pye:lib" pyexe.pye
Make sure to include stxdefender in your requirements.txt or pyinstaller dependencies so that the decryption module is available in the bundled executable.
You can encrypt your Django project just the same as you can any other Python code. Don't forget to include import stxdefender in the __init__.py file that is in the same directory as your settings.py file. Only encrypt your own code and not code generated by the Django commands. There is no point in protecting files such as urls.py as these should not contain much/any of your own code other than things that have been imported.
stxdefender activate --token <token>Activate your license with a token obtained from the dashboard.
stxdefender activate --token 470a7f2e76ac11eb94390242ac130002
stxdefender validateCheck your current license activation status. Returns exit code 0 if valid, 1 if invalid.
stxdefender validate
stxdefender encrypt [options] <file>Encrypt a Python source file.
Options:
--remove - Remove the original file after encryption--ttl=<time> - Set expiration time (e.g., 24h, 7d, 30m, 1w)--password=<pass> - Use a custom password (otherwise auto-generated)Examples:
# Basic encryption
stxdefender encrypt script.py
# With 24-hour expiration and remove original
stxdefender encrypt --remove --ttl=24h myapp.py
# With custom password
stxdefender encrypt --password=mysecret script.py
# Complex example
stxdefender encrypt --remove --ttl=7d --password=supersecret myapp.py
The --ttl option accepts the following formats:
30s - 30 seconds5m - 5 minutes24h - 24 hours7d - 7 days2w - 2 weeks365 - 365 seconds (numeric only = seconds)STXDEFENDER_API_URL - API endpoint URL (default: http://localhost:5000)STXDEFENDER_PASSWORD - Default password for encrypted filesIf you installed from source and want to run your own server:
Windows:
setup_and_run.bat (installs and runs)START.bat (quick start)run_server.bat (assumes dependencies installed)Linux/Mac:
./setup_and_run.sh
# OR
cd backend
python3 app.py
The server runs on http://localhost:5000 by default.
The backend uses SQLite by default (jsdefender.db for compatibility). For production deployments, consider using PostgreSQL or MySQL.
STXDefender implements multiple layers of security:
THE SOFTWARE IS PROVIDED "AS IS," AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. REVERSE ENGINEERING IS STRICTLY PROHIBITED.
This project is provided as-is for educational and development purposes.
Contributions are welcome! Please feel free to submit issues and pull requests.
For issues and questions, please open an issue on the project repository.
FAQs
Python Source Code Encryption Tool - Enterprise-grade protection for your Python source code
We found that stxdefender demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.
Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.
Security News
The planned feature introduces a review step before releases go live, following the Shai-Hulud attacks and a rocky migration off classic tokens that disrupted maintainer workflows.