string_obfuscation #

A build_runner generator that replaces annotated Dart string literals with obfuscated code at build time.

Installation #

Add the package and build_runner to your app:

dependencies:
  string_obfuscation: ^0.1.0

dev_dependencies:
  build_runner: ^2.4.15

Usage #

Create an abstract class, annotate it with @ClassEncrypt, and add a part directive for the generated file:

import 'package:string_obfuscation/string_obfuscation.dart';

part 'app_strings.gen.dart';

@ClassEncrypt(encryptKey: 'my-app-key')
abstract class AppStrings {
  @StringEncrypt(value: 'Welcome back')
  String get welcomeMessage;

  // When value is omitted, the getter name is used.
  String get confirm;
}

Generate the implementation:

dart run build_runner build

Use the generated instance (the class name with a lowercase first letter):

Text(appStrings.welcomeMessage);
Text(appStrings.confirm); // "confirm"

The generated file contains the encoded code units and decodes them when its getter is read.

JSON generation #

Write the constructor and add one-line delegates for fromJson and toJson:

@ClassJsonGenerator(encryptKey: 'my-app-key')
class User {
  final String name;
  final int? age;

  const User({required this.name, this.age});

  factory User.fromJson(Map<String, dynamic> json) => _$UserFromJson(json);

  Map<String, dynamic> toJson() => _$UserToJson(this);
}

The generated conversion functions obfuscate JSON field-name literals. Before casting a JSON value, fromJson checks its runtime type and throws a FormatException when it does not match the constructor parameter type.

Security note #

This package deters casual inspection of string literals in compiled output; it is not cryptography and must not be used to protect passwords, API keys, or other secrets. Values can be recovered by anyone who can inspect and run the application.