How vodka protects your Luau script. What actually happens.

When you build a script on vodka, your original source stays private and a separate protected artifact is produced for the players who load it. The build is not a single trick. It is a few transformations that each do a different job, applied in a fixed order and checked before anything ships.

The goal is honest: raise the effort of casual inspection and copying, not promise that protected code can never be read. An authorized client still receives the code it runs, so anything that must stay secret belongs on a server. This post walks through what the build does so you can judge it for your own script.

By default every build runs a set of source rewrites. They change how the program is written without changing what it does, so the protected script runs within noise of the original:

• Encoded constants. Strings and numbers are replaced with expressions whose decode step runs at load time, so literal secrets are not sitting in plain text in the file.
• Flattened control flow. The shape of supported code is rearranged, so the logic is harder to read top to bottom.
• Renamed locals. Local and upvalue names are rewritten with scope awareness, so meaningful names do not survive into the output.
• Minified and watermarked output. The result is compacted and carries a per-build watermark. The watermark is a build identifier, not a claim of tamper resistance.

Because these are source level changes, they keep behavior intact and cost very little at runtime. For most scripts this default is the right trade.

Maximum protection is a toggle you turn on per script. With it on, supported functions are compiled to bytecode and interpreted by a generated per-function virtual machine, with self-integrity anti-tamper on top of the default transformations. Functions outside the supported set keep native execution, so behavior is preserved.

It is the strongest option vodka offers and it is off by default for a reason: interpreting bytecode is slower than running native Luau, and that cost shows up most on hot or looping code. Turn it on when the secrecy matters more than the speed, and measure your script after you do. The benchmarks page publishes the overhead with the commands to reproduce it.

Every protected artifact is parsed and compiler-checked before it can become your published release. A failed, stale or cancelled build leaves your current working release exactly where it was, so a bad build never takes your script offline.

A successful build proves the artifact is valid, not that your script works everywhere. Test it in your intended environment, including its dependencies, callbacks, error paths and key expiry, before you point your community at a new release. Read what each protection layer does for the full picture.

Protection makes inspection harder. It does not make it impossible, and it cannot undo code that has already been delivered. A license key, a check that decides who gets access, or any value you cannot afford to leak should be verified server side, where the client never sees how the decision was made.

That is the honest boundary vodka works inside, and it is why the key system, expiry, revocation and HWID checks are all enforced on the server rather than trusted to the loader. Protection raises the cost of copying your work. Server-side checks are what actually gate access to it.