Java Compilation, Decompilation, and Obfuscation Using ProGuard and Maven

Hello, I am "Architect Jun", a developer who enjoys writing code and poetry.

Compilation simply runs the source code, converting .java files into .class files.

Decompilation reverses the process: the .class files inside a .jar or .war can be restored to readable source code using tools such as JD‑GUI .

To prevent others from easily reading your code, you can apply obfuscation . This article demonstrates how to use ProGuard for that purpose.

Step 1 – Create a ProGuard configuration file . Add a file named proguard.cfg in the project root with options such as target version, shrinking, optimization, class‑name handling, attribute preservation, and warning suppression.

# Specify Java version
-target 1.8
# Disable shrinking and optimization
-dontshrink
-dontoptimize
# Do not use mixed‑case class names
-dontusemixedcaseclassnames
# Use unique class‑member names
-useuniqueclassmembernames
# Adapt class strings for reflection
-adaptclassstrings
# Keep important attributes
-keepattributes Exceptions,InnerClasses,Signature,Deprecated,SourceFile,LineNumberTable,*Annotation*,EnclosingMethod
# Keep interface names
-keepnames interface ** { *; }
# Keep parameter names for frameworks like Spring or MyBatis
-keepparameternames
# Keep enum members
-keepclassmembers enum * { *; }
# Keep Spring beans and autowired fields
-keepclassmembers class * {
    @org.springframework.context.annotation.Bean *;
    @org.springframework.beans.factory.annotation.Autowired *;
    @org.springframework.beans.factory.annotation.Value *;
    @org.springframework.stereotype.Service *;
    @org.springframework.stereotype.Component *;
}
# Suppress warnings and notes
-ignorewarnings
-dontnote
# Print configuration for debugging
-printconfiguration
-keep public class com.example.myproguarddemo.MyproguarddemoApplication {
    public static void main(java.lang.String[]);
}

Comments in the file explain which classes are excluded from obfuscation, which enums are kept, and how to preserve method names required by frameworks.

Step 2 – Add the ProGuard Maven plugin . Insert the following plugin configuration into the <build> section of pom.xml :

<build>
    <plugins>
        <plugin>
            <groupId>com.github.wvengen</groupId>
            <artifactId>proguard-maven-plugin</artifactId>
            <version>2.6.0</version>
            <executions>
                <!-- Executes ProGuard during the package phase -->
                <execution>
                    <phase>package</phase>
                    <goals>
                        <goal>proguard</goal>
                    </goals>
                </execution>
            </executions>
            <configuration>
                <injar>${project.build.finalName}.jar</injar>
                <outjar>${project.build.finalName}.jar</outjar>
                <obfuscate>true</obfuscate>
                <proguardInclude>${project.basedir}/proguard.cfg</proguardInclude>
                <libs>
                    <lib>${java.home}/lib/rt.jar</lib>
                    <lib>${java.home}/lib/jce.jar</lib>
                    <lib>${java.home}/lib/jsse.jar</lib>
                </libs>
                <inLibsFilter>!META-INF/**,!META-INF/versions/9/**.class</inLibsFilter>
                <outputDirectory>${project.basedir}/target</outputDirectory>
                <options>
                    <!-- Additional ProGuard options can be placed here -->
                </options>
            </configuration>
        </plugin>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <executions>
                <execution>
                    <goals>
                        <goal>repackage</goal>
                    </goals>
                    <configuration>
                        <mainClass>com.example.myproguarddemo.MyproguarddemoApplication</mainClass>
                    </configuration>
                </execution>
            </executions>
        </plugin>
    </plugins>
</build>

After adding the plugin, run mvn package . Maven will compile the project, invoke ProGuard to obfuscate the bytecode according to proguard.cfg , and produce an obfuscated .jar file.

The resulting JAR can be inspected to verify that class names and method signatures have been scrambled, making reverse‑engineering considerably harder.

That concludes the tutorial on Java compilation, decompilation, and code obfuscation using ProGuard.