Jscrambler is a client-side security company that protects the code running in users’ browsers and mobile apps. Its platform hardens an organisation’s own JavaScript against tampering and reverse engineering, and controls what third-party scripts, iframes and embedded AI tools on a live website are allowed to read and send.
The company serves online retailers, banks, media and travel businesses that take payments or collect personal data on the web, and helps them meet browser-side compliance requirements such as PCI DSS v4 requirements 6.4.3 and 11.6.1.
At A Glance
| Vendor | Jscrambler |
|---|---|
| Category | Client-side security and JavaScript protection |
| Deployment | Code protection at build time, runtime protection in the browser |
| Agentic AI | Inventory and runtime controls for AI scripts, chatbots and agents embedded in web pages |
| Customers | Netflix, Airbnb, Booking.com, KLM, Nubank |
| Founded | 2010 |
| Market classification | DevSecOps |
What Jscrambler Does
A modern web page runs dozens of scripts in the visitor’s browser, many of them loaded from analytics, marketing and payment providers. That code sits outside the organisation’s own infrastructure, so a compromised tag or a skimming script can read card numbers and form fields without any server ever seeing it. Jscrambler gives security, privacy and compliance teams one control plane for this client side. It watches how each script behaves, which fields and storage it touches and where it sends data, then enforces least privilege on that basis.
Products
Code Integrity
Code Integrity is for teams whose business logic, anti-fraud checks or licensing lives in JavaScript or mobile app code. Each build produces a unique polymorphic obfuscated output, which the company says makes “LLM-driven comprehension at scale virtually impossible”. The protected code carries its own runtime checks, so it can detect tampering, debugging and poisoning attempts and respond with countermeasures or self-repair. Code locks restrict where the code will run by browser, date, domain or operating system, and anti monkey patching, code watermarking and real-time alerts round out the module.
Webpage Integrity
Webpage Integrity tackles web skimming, Magecart attacks, formjacking and third-party supply chain risk on live sites. It builds an automatic inventory of every script on a website and maps how each one interacts with sensitive fields, then assesses third-party risk continuously and surfaces shadow scripts. Field-level controls govern access to forms, cookies and browser storage, and behavioural drift detection compares activity with historic baselines. For PCI DSS v4 assessments it produces evidence that payment page scripts were authorised and monitored. A companion module, Iframe Integrity, applies the same governance to embedded iframes such as hosted payment forms and third-party widgets.
How It Works
Jscrambler acts in two places. During the customer’s build, Code Integrity transforms the code and injects its protections, generating a fresh obfuscated version with every release. At runtime, Webpage Integrity monitors scripts as they execute on live pages and decides what data each may reach and which outbound requests it may make. Telemetry from both flows back to the platform.
Code Integrity supports JavaScript, Node, Angular, Vue, Next.js, HTML5 and PWA on the web, and Android, Kotlin, Swift, Flutter, Ionic, Cordova and NativeScript on mobile.
Agentic AI Capabilities
Embedded AI Inventory
The AI Data Governance and Security solution finds every AI script, chatbot and agent embedded in live browser sessions, giving teams a view of AI tools that marketing or product groups may have added without review.
Runtime Limits For AI Agents
Runtime controls restrict what embedded AI agents can access, including stopping AI scripts from scraping contextual signals or proprietary application state.
AI-Driven Exfiltration Prevention
This feature blocks sensitive data from being ingested by external AI models and prevents prompt leakage. Anomalies such as an AI script reading a new field are flagged and blocked, and browser-based AI activity is written to audit-ready logs.
Integrations
| Area | Integrations |
|---|---|
| Payments | Stripe, PayPal |
| Marketing and analytics | Google Analytics, Salesforce, Zapier, Cookiebot, tag managers and pixels |
Company Background
| Founded | 2010, to address client-side application risk. |
|---|---|
| Leadership | Rui Ribeiro (CEO and Co-Founder) and Pedro Fortuna (CTO and Co-Founder). |
| Investors | BrightPixel, Portugal Ventures, Iberis Capital and Tikehau Capital. |
| Scale | More than 9 billion reported protected web sessions and more than 19 million reported blocked browser data access attempts. |
| Recognition | Recognised in the 2026 Global InfoSec Awards and the 2026 Globee Cybersecurity Awards (Core Application Security Innovation). |
Note: This overview is compiled from Jscrambler’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.