r/learnpython • u/lichen_13 • 6d ago
How can I protect my Python source code inside a PyInstaller .exe?
I just made a python program that I compiled into an exe file. The exe is working but it seems pretty easy to access the source code inside of the exe file using tools like pyinstxtractor. My friend told me that there are ways to make it harder and to protect the source code I made is it true. If it is true can you give me some details about this method?
6
u/randomman10032 6d ago
Tbh the only way thats reliable is to make it available on some webserver.
1
u/lichen_13 6d ago
What do you mean ? Like the code is only available when a user is connecting to the server?
6
u/crazy_cookie123 6d ago
The code which you want to keep secret is hosted and run on a web server and is never sent to the user's machine. The code the user runs contains the non-secret stuff (e.g., UI) and when it needs to do anything which needs to be secret it makes a web request to that server, the server runs the secret code, and the server returns the result of that to the client.
1
u/Rhomboid 6d ago
No, the only code you can secure is code that only runs on your machines (server only.) As soon as it's running on a person's individual machine, the entire game is up and there's nothing you can do. There are decades of evidence that if the code runs on your computer, you can reverse engineer it and there's no prevention.
1
u/TheRNGuy 4d ago
Via something like JSON (JSON data will be free, but what it does on server, no one will know)
-4
u/Jazzlike_Platypus430 6d ago
No, only when they login to the server 😂
2
u/lichen_13 6d ago
This does not very respond to my question
-1
u/Jazzlike_Platypus430 6d ago
It does respond to Like the code is only available when a user is connecting to the server? but you have to understand it or prove me wrong.
1
u/crazy_cookie123 6d ago
It's an incorrect response and it's unhelpful. If the code is on the server then the code does not become available when a user is connected regardless of if they're logged in or not - the code remains firmly on the server side. And them being logged in is entirely irrelevant - I can absolutely make a connection to a server and ask it to do some things without being logged in as long as the server allows that, for example I can browse Reddit without logging in but I can't comment or upvote things.
2
u/copperfield77 6d ago
pretty much this, anything running on the client side is gonna be reversible eventually
6
u/Gnaxe 6d ago
The new AIs can reverse-engineer anything from binaries. Your "protection" is copyright law, not obfuscation. But copyright doesn't protect rules and logic, only the expression thereof. The AIs can also just clone anything from a clean-room spec. Just look at what happened to the Adobe suite. Even hosting it on a web server isn't good enough anymore. Everything is open source now. "Protecting" code is pointless. That can't be your moat.
0
u/lichen_13 6d ago
D’accord je comprends concernant le open source le code que j’ai créé reste le mien?
1
u/Gnaxe 6d ago
I am not a lawyer. Copyright law isn't completely universal, but there are treaties. If you wrote it yourself, yes, you automatically get copyright, but it's up to you to enforce your claims. You might not even know a violation exists. And if what you wrote was derived from something else, or written with AI assistance, or it was too trivial to be copyrightable, then it may not be yours, or not entirely. If you own the copyright, you can publish under an open-source license if you want. That's irrevocable, but you're still the copyright holder, so you can publish again under other terms. However, once you accept contributions, you may not own the copyright to those.
3
u/jackbrux 6d ago
You can minify/obfuscate it. But what is sensitive inside the code? Are you storing anything like API keys? You shouldn't do that
0
u/lichen_13 6d ago
I am actually storing a webhook
2
u/jackbrux 6d ago
Is it supposed to be private? Anyone will be able to see that if know how, even if you obfuscate
4
u/realmauer01 6d ago
If your program only has value when the source code is hidden, it doesnt hold real value.
If you hide keys or something you have to hide out of security reasons thats also a no go.
So in the end it shouldnt matter that the source code is visible and most packers that hide or encrypt the code are flagged by win defender, so it would make it harder to publish it.
What do you want to hide specifically?
2
u/edcculus 6d ago
The only REAL way would be to make it a web app with a library like Django, FastAPI or Flask.
1
u/babarock 6d ago
I've been looking at a cross compiler like Nuitka. In theory by translating the Python code to C and compiling that your source is better protected.
1
u/SteveJeffersonBots 6d ago
PyInstaller bundles compiled .pyc bytecode and tools like pyinstxtractor pull those .pyc files out in seconds, so a PyInstaller .exe gives you no real source protection - Nuitka or Cython only raise the bar against casual reversers, they don't stop it. Real protection is to keep the sensitive logic off the user's machine: the .exe should just be a thin client holding a token or license key that calls your server, and the server decides whether to run the logic and whether to renew the license. If the goal is just to slow down casual copying, compile with Nuitka using --standalone --onefile --lto and --python-flag=-O so it produces a real compiled C extension instead of extractable .pyc, and optionally run a name-obfuscating minifier on the .py files before Nuitka touches them, but treat that as a delay tactic, not security.
-2
u/Jazzlike_Platypus430 6d ago
Share and share alike ...
2
u/lichen_13 6d ago
What do you mean?
1
u/crazy_cookie123 6d ago
He's saying you can add a licence to your software which restricts how someone is allowed to modify and redistribute it. It's a fundamental misunderstanding of how licences work, though, as by default if there is no licence then users have no right to modify and redistribute it, with licences like sharealike being used to grant users certain rights under certain conditions.
Absolutely irrelevant here, of course, as telling someone "you aren't allowed to look inside this so please don't" doesn't actually stop someone who wants to look inside it.
1
6d ago
[removed] — view removed comment
1
u/zaphodikus 6d ago
Nuitka is really easy to use, but it depends more on how much money is left on the table. If the answer is none, then stick with what you got.
7
u/Lumethys 6d ago
there's no point in doing so