`), they will be obfuscated too. If they're applied via `@apply` from another component-utility CSS layer, the situation is more complex and may not round-trip cleanly.
**Workaround** : prefer using `@apply` inside `@layer components { … }` so the rendered class names appear directly in the HTML and are obfuscated like any other utility. Avoid chained `@apply` from inside `@plugin` definitions.
**Tracked in** : no current issue ; please open one with a repro if this affects you.
:::
---
## Comparison-with-others scoring justifications
Cells in [`docs/research/comparison.md`](../research/comparison) marked `❌` for the competitor (`tailwindcss-mangle`, `Obfustail`) reflect what is true about those projects today. We don't claim the competitors will _never_ implement these — we claim they don't today. Each `❌` in that table corresponds to a specific verifiable absence:
- **AST-based JSX/TSX extraction (Babel)** : `tailwindcss-mangle` uses regex string-matching, `Obfustail` uses per-string regex replace. Neither parses the AST. Verifiable by reading their source.
- **Tailwind v4 support without config file** : `Obfustail` requires `tailwind.config.js` which v4 deprecated. Verifiable by attempting to use it on a v4 project.
- **Per-utility obfuscation** : `Obfustail` rewrites whole strings, not individual utilities, so two strings sharing 90% of their utilities still get fully different obfuscated forms (no reuse). Verifiable by inspecting their output.
- **Provenance / OpenSSF / SBOM** : verifiable by checking each competitor's npm metadata and GitHub repo. As of 2026-04, neither competitor publishes with provenance attestations or has an OpenSSF Scorecard score.
If any of these claims becomes outdated (e.g. a competitor ships v4 support tomorrow), the comparison table — and this page — must be updated in the same PR.
---
## Things we will not implement
Some absences are by design, not by oversight. They live here so you don't waste time opening an issue for them.
### Runtime obfuscation
::: danger By-design : the obfuscator is build-time only
**Why** : a runtime obfuscator would need to ship a JavaScript class-mapping table to every visitor, defeating the entire bundle-shrink benefit (the table grows with the design system). It would also defeat reverse-engineering protection — the mapping is right there in the bundle.
**Alternative** : if you need per-request randomisation (e.g. to defeat scrapers that scrape your CSS class names today and your obfuscated names tomorrow), use a CDN-side rewrite layer instead of a runtime obfuscator. Several edge platforms can do this in 10 lines of Cloudflare Worker / Vercel Middleware.
:::
### Deobfuscation in the browser DevTools
::: danger By-design : we don't ship a DevTools extension
**Why** : the `.tw-obfuscation/class-mapping.json` file emitted at build time _is_ the deobfuscation. Open it in any text editor or pipe it through `jq` to reverse a `tw-XXX` to its original utility name.
**Alternative** : if you want a browser overlay that decodes classes live (e.g. for debugging in production), build it on top of the mapping JSON — it's a 50-line userscript. We'd happily link to a community extension if one exists.
:::
### Obfuscation that survives a downstream `tailwind-merge` call at runtime
::: warning By-design : tailwind-merge runs after the bundle is produced, so it can't be obfuscated retroactively
**Why** : `twMerge()` (from the `tailwind-merge` library) is a _runtime_ function that resolves Tailwind utility conflicts (e.g. `twMerge("p-4 p-2")` → `"p-2"`). The obfuscator runs at build time and produces a final mapping ; if `twMerge` then receives obfuscated strings at runtime, it cannot resolve their conflicts because it doesn't know what each `tw-XXX` originally meant.
**Workaround** : use `twMerge` BEFORE the obfuscator sees the final string. The standard pattern is to wrap `twMerge` inside `cn()` (the shadcn convention) which the obfuscator's AST extractor knows how to inspect — it sees the Tailwind utility string at build time, before `twMerge` is even invoked at runtime.
```jsx
// ✅ Recommended — twMerge runs at runtime on already-obfuscated strings,
// but the AST extractor saw the original utilities through cn() at build time
import { cn } from "@/lib/utils";
;
```
**Tracked in** : intentional, see [test-shadcn-ui](https://github.com/josedacosta/tailwindcss-obfuscator/tree/main/apps/test-shadcn-ui) for the canonical pattern.
:::
---
## How to keep this page honest
Whenever a `❌` / `⚠️` / "Not supported" / "Partial" lands in the documentation, the project's documentation rule requires it to be paired with a card on this page (or a one-line link to the existing card). If you find a bare `❌` anywhere on the docs site without a card or link explaining it, please [open a doc bug](https://github.com/josedacosta/tailwindcss-obfuscator/issues/new/choose).