If I go on a website, can I read the source code of the JavaScript files?

Even if the code is obfuscated? I precise, not for compression reason, but obfuscated in order to transform the code less readable.

Next, can I modify on the fly the code with my browser (like Chrome for example)? Is this also legal to create a patch for a website? With GreaseMonkey for example?

Now, in this virtual situation,

  1. Take a random free game.
  2. This is an online game (with websocket technology for example).
  3. And this game is totally free but contains adverts. So we can deduce author of the game intends to make money with their creation.
  4. Their code are obfuscated, not with a minifier easily indentable (which is more a compressor than a real obfuscator), but with a "real" obfuscator that transform the original code in something less readable for humain.
  5. The authors of the website explicitely said that they do not want that other people read and modify 'on the fly' their code.

So in this precise situation:

  • Do I have the right to modify on the fly (and also create a patch) in order to correct a bug?
  • Do I have the right to explain to others people how this code works?
  • Do I have the right to modify on the fly the code in order to cheat in this game and explain to other for educational purpose (and free)?

An example for the last point: I modify part of the code that said "my life is 50/100" and I send another message to the server: "my life is 100/100". By using their function to send data about our own life points.

Original code (deobscated) of the developper of this random game:

var send_my_life = function (my_life) { socket.emit (my_life); }

Transformed function (on the fly or in the patch):

var send_my_life = function (my_life) { socket.emit (100); }

I create this example in order to determinate if their exists any borders to the law. I mean, behind this border I can probably do my modifications (for example the game is not online). And accross this borders (for example player can make money with this game) = I probably should not modify the game.

  • Most games don't send anything to the server other than the inputs.
    – Bálint
    Commented Jan 7, 2017 at 15:34
  • Most games, but not all. And what if I want to create an aim bot ? But It's not the question. Commented Jan 7, 2017 at 15:56

2 Answers 2


In general, Yes, it is legal to read and edit your web browser code on-the-fly. That is why such tools exist; and by processing code client-side, the authors submit to that possibility. If there is something which a website wishes to make absolutely sure you won't mess with, they will process this information server-side, as per – Bálint's comment.

Now as you pointed out, in the example you brought up, the code is compressed but not obfuscated to make it harder for a human to read. This is usually the norm. Because things that obfuscate the code, they make it take longer for a human to figure out how to manipulate it; however, they don't actually prevent a human from doing it; also, once a human has figured it out, he can explain it to others without legal repercussions -- whether it is to correct a bug, or to cheat. And any author who makes his code available as JavaScript, has to bear full acknowledgement of the fact that his code can be manipulated.

Now, there is one exception. You say:

The authors of the website explicitely said that they does not want that other people read and modify 'on the fly' their code.

If this is something that you had to click "I agree" to, then it is legally binding. Therefore, if you must check to box agreeing not to modify the JavaScript code before you can download it, then it is protected by law. Otherwise, the author will have to prove that you were aware of his requirements, before he can legally prosecute you. (For example, if he can find a log that shows you read the ToS, and he can reasonably prove that it was you, e.g. by IP address, then he can prosecute you; however, in practice, such things are usually very hard to prove.) See "browserwrap" vs. "clickwrap" for more details about this.

  • 1
    "that is why the code is processed client-side" - I think it is safe to say that in the vast majority of cases, website visitors being able to read client side code is at best an accepted side-effect, but in no way an intentional goal that would factor into the decision to implement a given functionality on the client side. Commented May 28, 2018 at 16:42
  • What I meant was, this is why private things, such as banking information or password hashes, are not processed client-side. You don't want the password hash to be calculated client-side, and then sent to the server to be stored. But I updated the phrasing anyways; thanks!
    – Alex
    Commented May 28, 2018 at 16:51
  • "...That is why such tools exist." Yes, such tools exist; but their existence doesn't make their use legal. Does the fact that malware exists make the use of malware legal? Commented May 28, 2018 at 20:37
  • There is some doubt as to if clicking "I agree" has any meaning in Europe.
    – user
    Commented May 30, 2018 at 9:22

Yes, as long as you don't circumvent measures (such as cracking a paid software you need to pay for) and you don't distribute it (unless the copyright owner says so).

If you are trying to hack a compter, then stop right now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .