> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/csharp-document/other-func/string-obfuscation.md).

# String Obfuscation

String protection prevents reverse engineers from finding sensitive text, API endpoints, encryption keys, and internal method names through static string analysis tools (such as `strings.exe`, IDA Pro string tables, or dnSpy string search).

***

## Multi-Layer String Protection

{% tabs %}
{% tab title="Native Core Obfuscation" %}
Inside the native `qPapelEasyAuth.dll` core, all strings and API names are encrypted at compile-time using constexpr stack strings and OLLVM string encryption passes. Strings are decrypted on the stack only during the clock cycle of their execution and zeroed immediately.
{% endtab %}

{% tab title="Managed C# Protection" %}
In managed .NET assemblies, strings are typically stored in the `#US` (User Strings) metadata stream, which disassemblers like dnSpy or ILSpy read in plaintext.

To secure managed strings:

1. Use server-side variables ([Serverside Variables](broken://pages/4028215e4806c9fd61e234d2f047fee6b06b899e)) for sensitive credentials and endpoints.
2. Apply an obfuscator (such as Obfuscar, ConfuserEx, or VMProtect) to encrypt the managed `#US` string stream before running `qPapelPacker`.
   {% endtab %}
   {% endtabs %}

***

## Recommended Obfuscar Configuration

Below is a standard `obfuscar.xml` configuration for encrypting string literals in your C# client application:

```xml
<?xml version="1.0" encoding="utf-8" ?>
<Obfuscator>
  <Var name="InPath" value=".\bin\x64\Release\net8.0" />
  <Var name="OutPath" value=".\bin\x64\Release\net8.0\obfuscated" />
  <Var name="KeepPublicApi" value="false" />
  <Var name="HidePrivateApi" value="true" />
  <Var name="RenameProperties" value="true" />
  <Var name="RenameEvents" value="true" />
  <Var name="RenameFields" value="true" />
  <Var name="UseUnicodeNames" value="false" />
  <Var name="HideStrings" value="true" />
  <Var name="OptimizeMethods" value="true" />
  <Var name="SuppressIldasm" value="true" />

  <Module file="$(InPath)\YourApp.dll" />
</Obfuscator>
```

***

## Best Practices

* **Never Hardcode Secrets**: Never hardcode administrative tokens, master database passwords, or private encryption keys in managed C# code.
* **Utilize Serverside Assets**: Deliver critical strings from the server using `qPapelEasyAuth.GetVariable()` after the user is authenticated.

{% hint style="info" %}
Always run `qPapelPacker` as the final build step after managed obfuscation tools have completed processing.
{% endhint %}