Garble
What it is
Garble is a free Linux command-line tool that wraps the Go toolchain to obfuscate builds while aiming to preserve program behavior. It supports garble build, garble test, and garble run, plus commands for reversing obfuscated text and filing bug reports. The tool replaces identifiers and package paths with short base64 hashes and removes build, module, and debug information. The optional -literals flag rewrites eligible literal expressions into more complex expressions with the same runtime value. The optional -tiny flag removes additional binary information and can make binaries about 15% smaller, but removes panic output and can make crashes harder to debug. Builds are deterministic for identical inputs, and reverse can de-obfuscate stack traces when required inputs are available. A build takes about twice as long as go build. Supported packages include the standard runtime; runtime/cgo and crypto/internal/fips140 are excluded. Exported methods, Go plugins, and certain runtime APIs remain limitations.
For and against
For
- Obfuscates identifiers and package paths
- Removes build and debug metadata
- Offers deterministic builds
- Can reverse stack traces with inputs
- Provides build, test, and run commands
Against
- Builds take about twice as long as go build
- Exported methods are not obfuscated
- Go plugins are unsupported
- Tiny mode removes panic output
The verdict
Garble adds configurable obfuscation to Go’s build workflow through a command-line wrapper. Developers should account for unsupported plugins, runtime APIs, and the longer build process.
Who it suits
Garble suits Go developers distributing private or paid binaries who want to discourage reverse engineering. It runs on Linux and requires Go 1.27 or later.
Plans and prices
Garble
Free Go code obfuscator; requires Go 1.27 or later
Read 8 Oct 2026 · github.com
On the record
- Build commands
- It supports garble build, garble test, and garble run, plus commands to reverse obfuscated text and file bug reports.github.com · read 8 Oct 2026
- Build time
- A garble build should take about twice as long as go build because it completes an original build and an obfuscated build.github.com · read 8 Oct 2026
- Identifier obfuscation
- It replaces identifiers and package paths with short base64 hashes.github.com · read 8 Oct 2026
- Limit: exported methods
- Exported methods are not currently obfuscated because they may be required by interfaces.github.com · read 8 Oct 2026
- Limit: plugins
- Go plugins are not currently supported.github.com · read 8 Oct 2026
- Limit: runtime APIs
- APIs such as runtime.GOROOT and runtime/debug.ReadBuildInfo will not work in obfuscated binaries.github.com · read 8 Oct 2026
- Literal obfuscation
- The optional -literals flag replaces eligible literal expressions with more complex expressions that resolve to the same runtime value.github.com · read 8 Oct 2026
- Metadata removal
- It removes build, module, and debug information from obfuscated builds.github.com · read 8 Oct 2026
- Purpose
- Garble wraps the Go toolchain to obfuscate Go builds while aiming to preserve their behavior.github.com · read 8 Oct 2026
- Release signing
- The v0.18.0 release page says its tag was signed with the committer’s verified signature.github.com · read 8 Oct 2026
- Reproducible builds
- Garble builds are deterministic given the same inputs, and its reverse command can de-obfuscate stack traces when the needed inputs are available.github.com · read 8 Oct 2026
- Supported packages
- Garble obfuscates supported packages being built, including the standard runtime, while runtime/cgo and crypto/internal/fips140 are excluded.github.com · read 8 Oct 2026
- Tiny mode
- The optional -tiny flag removes more binary information and can make binaries about 15% smaller, but removes panic output and can make crashes harder to debug.github.com · read 8 Oct 2026
- Use case
- The project describes obfuscation as useful when sharing Go binaries whose source is private or requires purchase, to help discourage reverse engineering.github.com · read 8 Oct 2026
