---
title: "Protect your Flutter iOS apps with Shorebird Obfuscation"
description: "Shorebird now supports code obfuscation for iOS. Protect your Flutter apps across platforms with the --obfuscate flag on Code Push."
url: https://shorebird.dev/blog/obfuscation-on-ios/
---

[Blog](/blog)

[Product updates](/blog/category/product) February 27, 2026 2 min read

# Obfuscation on iOS now available in Shorebird

Whether you're targeting iOS, Android, or any other platform Shorebird supports, obfuscation works consistently across the board.

![](/_astro/brandon-derosier.DY2IRvmt_Nu4Hr.webp)

Brandon DeRosier

Software Engineer

Obfuscation has always been supported for non-iOS platforms in Shorebird and supporting it in iOS has long been one of the [most requested features](https://github.com/shorebirdtech/shorebird/issues/1619) from our community. As of Flutter 3.41.2,**–obfuscate**is now a first-class CLI flag in Shorebird. Code Push has revolutionized how you update your Flutter apps, letting you fix bugs and ship features without the delays of app store review processes. But shipping fast isn’t enough, you also need the protection of obfuscation.

Starting today, you can use the **`--obfuscate`** flag during release commands across all platforms. The tool will remember if you used **`–-obfuscate`** during release and automatically do so during patch.

## Why Obfuscation Matters

Obfuscation transforms your readable, well-structured code into something that looks like alphabet soup to anyone trying to reverse-engineer it. Variable names become meaningless strings, class structures get reorganized, and the logic that took you weeks to perfect becomes nearly impossible for bad actors to decipher.

No obfuscation can ever fully hide your code, but it does make it much harder for someone to understand the code without the original source or the obfuscation map. Some regions and regulated industries even require developers to use obfuscation.

It’s important to call out that obfuscation does not hide API keys and sensitive data, it hides the function/class names from your source code. Obfuscation is not a replacement for strong security practices, it should be used in addition to existing security practices like storing keys in environment variables and using dedicated secret management services.

## How It Works

To use obfuscation in Shorebird add the **`--obfuscate`** flag to `release` command. Shorebird remembers that you used **–obfuscate** for the release and will automatically obfuscate patches:

* When releasing: **`shorebird release --obfuscate`**
* When patching: **`shorebird patch`**

That’s it. Whether you’re targeting iOS, Android, or any other platform Shorebird supports, obfuscation works consistently across the board.

## The Bottom Line

Your code represents your competitive advantage and your hard work. With obfuscation now built directly into Shorebird’s CLI, you get enterprise-grade security without sacrificing the developer experience.

Ready to start obfuscating? Check out our [documentation](https://docs.shorebird.dev/code-push/guides/security-tools/) for more information.

## More from the blog

[All posts](/blog)

* Product updates Nov 3, 2026 4 min read

  ### [Shorebird improvements for enterprises](/blog/enterprise-console)

  Meet the enterprise console: your whole company's Shorebird setup in one place, with SCIM from Okta and Entra ID, organization members, contract billing, offboarding and one audit log.

  ![](/_astro/wesley-peck.C4oaIDVg_ZANUra.webp)

  Wesley Peck

  Lead Product Manager

* Product updates Oct 30, 2026 2 min read

  ### [Orgs at Shorebird just got better](/blog/orgs-at-shorebird-just-got-better)

  Shorebird now has one kind of organization. Your personal org works like any other org, and org membership replaces app collaborators.

  ![](/_astro/wesley-peck.C4oaIDVg_ZANUra.webp)

  Wesley Peck

  Lead Product Manager

* Product updates Oct 29, 2026 5 min read

  ### [Your CI shouldn't run on someone's personal key](/blog/service-accounts-for-ci)

  Service accounts give your release pipeline its own identity in your organization, with a fixed role and keys that keep working as your team changes. On GitHub Actions, you can drop the stored key entirely.

  ![](/_astro/abhishek-doshi.DveI0bx__ZfWpAX.webp)

  Abhishek Doshi

  Developer Relations Engineer

## Ship your first patch today.

Install the CLI, create a release and send a patch. Free for 5,000 patch installs a month.

[Start for free](https://console.shorebird.dev/login) [Read the quickstart](https://docs.shorebird.dev/getting-started/)

Larger team? [Talk to sales](/talk-to-sales)