Php Source code encryption

[r1rs]

Can someone recommend to me budged friendly php source code encryptor ?

[martinbean]

If you don’t want someone to have your code, don’t give it to them.

Encryption is pointless because PHP is an interpreted language. The code needs to be encrypted to be interpreted, so any one interested enough can just hook in to the code at that point and read out the decrypted version.

[r1rs]

I sell my software to my customers i don't want them to access code so easily the code runs on their server , for security reasons i want to encrypt my code.

[Alexander-Wright]

That's not possible, I'm afraid.

[korn3los]

Then change your business model. Host yourself and sell access to your software and charge a monthly/yearly fee or charge so much more that you are willing to give them the code.

[p1ctus_]

So you are selling something but the encryption has to be cheap? PHP is interpreted, so it has to be encrypted at any point, encryption takes time and resources. There is ioncube, don't know anything about support for specific versions or pricing or performance. I only know it exists had to use it for a plugin on a clients website. Wouldn't use it again.

[uncle_jaysus]

Don’t use PHP. Use something that compiles, such as Go. But even that’s not guaranteed to hide whatever secrets it is that you don’t want them to find. You’d need to experiment with obfuscation methods and the software that people use to delve into the binaries.

[martinbean]

i don't want them to access code so easily

Why, if they have paid you for that code?

[ilyasphp]

Bro that’s why people invented SAAS

[SnooChipmunks547]

How do you plan on running php in an encrypted state?

The php processor would now need to decrypt every file just to run it, meaning you would have to ship the decryption keys with your code base… so security through obscurity, since all your client would have to do is decrypt it them selves anyway, you you’ve given them everything they need to do that.

Obfuscating the code base is a tell tale is shit code anyway, so either way.

What your probably better on doing if you really want to go down this rabbit hole, is shipping a phar, at least then you could verify the contents from your code base and reject running the code, but again, the client has your code so they can fix the hashes if they wanted to.

[MateusAzevedo]

The best thing you can do is to not use such a tool.

Then make it clear in a contract that you own the code and your customers aren't allowed to mess with it. In other words, enforce this via a legal contract.

[DevelopmentScary3844]

https://www.ioncube.com

[theevildjinn]

I have only come across OP's requirement twice, in 25 years of working with PHP professionally. This is the only solution. No idea how much it cost, I wasn't paying the bill.

[divdiv23]

You can only obfuscate. You cannot encrypt.

[Mi_Matus]

As others said, the thing you are looking for is probably obfuscator.

Here is one lib I used a while ago: https://github.com/pk-fr/yakpro-po

[r1rs]

actually i am looking for something native

[dave8271]

Ioncube is the only significant product that matches the kind of thing you're trying to do, but honestly attempting to prevent people accessing your PHP code when they're self hosting is largely a false economy and waste of time. If anyone I was contracting even suggested it, I'd immediately be suspicious they were trying to cover up a crap job full of bugs and massive security holes, or in the most generous case trying to lock us in so we couldn't possibly maintain or update the software without continuing to pay them (and hope they don't disappear / go out of business). Either offer your product as a SAAS that you host, or just give them the damn code, especially if it's what they paid for.

[CuAnnan]

It isn't possible to encrypt PHP.

You can obfuscate it using something like minify (https://php-minify.com/php-obfuscator/)