vodka / A Hercules alternative
A Hercules alternative. From a local CLI to a complete platform.
Hercules is a free, open-source Lua obfuscator you run yourself. vodka is a free, hosted platform: the same idea of protecting your code, plus a key system, delivery and reproducible benchmarks, without running a toolchain locally.
Yours from
the first line.
Saved privately
Validated before publishing
Your next release, same address
Your release workflow / illustrated
The short version
A platform, not a command-line step.
Hercules is a free, open-source Lua obfuscator. You run it on your own machine and it transforms a file. That is a useful building block, and if a local CLI is exactly what you want, it does its job.
vodka is a free, hosted platform. It protects your Lua and Luau source and, in the same workspace, runs a key system, a stable loadstring, a Discord bot, HWID locking and a developer API. You get the protection and the distribution together, without wiring up a local build step.
Both are free
This is not a free-versus-paid comparison. Both cost nothing.
The difference is a local obfuscation step versus a hosted platform that also delivers, keys and measures itself.
What the platform adds
The parts a CLI leaves to you.
Keys, delivery and a bot
vodka runs the whole access flow: free-key tasks, lifetimes, HWID locks and revocation, enforced on the server, with a Discord bot for redemption and support.
Publishing gives you one stable loadstring that future builds reuse, so your players keep the same link.
A current toolchain, measured
vodka tracks the current Luau runtime and differential-tests behavior against it, so supported code runs the same after protection. Unsupported constructs fall back to native so behavior is preserved.
The engine is measured in a committed benchmark harness with seeds and dates, including what it does not defeat.
Where protection ends
Honest about the boundary.
No client-side obfuscator can make a delivered secret unrecoverable. An authorized client receives the code it runs, so running the loader can recover the strings and reverse the arithmetic. This is true of every obfuscator, vodka included, and we will not pretend otherwise.
What protection does is raise the cost of casual inspection and copying. What actually gates access is server-side: the key check, expiry, revocation and HWID locks are all enforced where the client never sees how the decision was made. Keep anything that must stay secret on a server, and read the benchmarks for exactly what the engine does and does not defeat.
Keep exploring
Where to go next.
The obfuscator
Encoded constants, flattened control flow and an opt-in bytecode VM for your Roblox Lua and Luau scripts.
Reproducible benchmarks
Run the exact harness yourself: protection resistance, runtime overhead and the weaknesses we do not hide.
What the engine does
The protection pipeline layer by layer, and a plain account of what it does and does not defend against.
The key system
Free-key tasks, HWID locks, revocation and a Discord bot, enforced on the server rather than in the loader.
Questions
A few things worth knowing.
01How is vodka different from Hercules?
Hercules is a free, open-source Lua obfuscator you run locally. vodka is a free, hosted platform that protects your code and also runs a key system, delivery, a Discord bot, HWID locking and a developer API. Both are free; the difference is a local CLI step versus a complete hosted platform.
02Is vodka open source?
No. vodka is a hosted service rather than a tool you download, and its engine is not published as source. What it does publish is a reproducible benchmark harness, so you can measure the protection even though you do not run the engine yourself.
03Do I need to run anything locally?
No. You paste or upload your source in the workspace, build a protected release in the browser and get a stable loadstring to distribute. There is no local toolchain to install or keep updated.
04Does vodka work with current Luau?
Yes. vodka targets the current Luau runtime and differential-tests behavior against it. Supported constructs run the same after protection, and unsupported ones fall back to native execution so behavior is preserved.
Keep building
Your next release starts here.
Bring your original source. Make the workspace your own.