phpQ
Studio
Elite PHP Code Encoder • Cross-Platform Windows & Linux

Elite PHP Code Encoder
Absolute Bytecode Security for Windows & Linux

phpQ is an Elite PHP Code Encoder & Protection Suite delivering commercial-grade intellectual property shielding for PHP 7.x & 8.x: Authenticated AES-256-GCM encryption, deep AST shredding, ECDSA P-256 asymmetric licensing, and military-grade Native Hardware-Level Code Virtualization. Available as a portable 1-click suite for Windows and native binary for Linux.

Download phpQ Suite Online Studio Playground Explore CLI Usage
terminal - Elite PHP Code Encoder CLI
Windows • Linux
$ phpQ protect.txt # or: phpQ.exe protect.txt on Windows
========================================================================
phpQ Building Project: [ECOMMERCE_PROD_2026]
========================================================================
Config File: protect.txt
Source Dir: ./source
Target Dir: ./dist_protected
Project Lock: ENABLED (HMAC-SHA256 Interlocked)
Expires: +365 days (Hardware Machine ID Interlocked)
------------------------------------------------------------------------
[OK] Encoded [Shredded AST]: App/Http/Controllers/OrderController.php (14 KB -> 4.2 KB)
[OK] Encoded [Shredded AST]: App/Services/PaymentGateway.php (28 KB -> 9.1 KB)
[COPY] resources/views/invoice.blade.php
[LICENSE] Auto-generated 'web.lic' (ECDSA P-256 Asymmetric Key)
========================================================================
Build Summary: 42 files encoded, 18 assets copied. Ready for production!
Distribution Center

Download phpQ Suite

Pre-compiled, monolithic, and hardened binaries with Native Code Virtualization. Zero setup required on Windows, instant installation on Linux.

PORTABLE 1-CLICK

phpQ for Windows

Complete portable studio for Windows 10, 11, and Windows Server (64-bit). No PHP installation required.

File: phpQ-windows-portable.zip
Size: 64 MB
Contains: phpQ.exe + Bundled PHP 8 + Examples
Protection: Native Code Virtualization
  • Drag & drop protect.txt onto phpQ.exe for instant build
  • Pre-configured 1-click batch scripts (Batch encoding, single file, licensing)
  • Bundled with phpq.dll for XAMPP, Laragon, IIS & CLI
Download Windows Suite (ZIP) Download Loader phpq.dll (PHP 8.0 - 8.4 x64)
UBUNTU / LINUX

phpQ Linux Suite

Complete encoding compiler and runtime loader suite for Ubuntu, Debian, CentOS, RHEL, and AlmaLinux.

File: phpQ-ubuntu-suite.tar.gz
Size: 14 MB
Contains: phpQ CLI + phpQ-nts.so + phpQ-ts.so
Guide: Web Setup Guide (/setup)
  • Standalone phpQ CLI binary compiler for Linux
  • Load via /etc/php/X.Y/mods-available/ • phpenmod phpq
  • Universal ABI Adapter compatible with PHP 7.3 – 8.4
Download Linux Suite (14MB)
CLIENT LOADER ONLY

Linux Loader Deployment

Redistributable client package for production web servers on Ubuntu/Linux (runtime loader only).

File: phpQ-loader-ubuntu.tar.gz
Includes: phpQ-nts.so + Setup Guide
Excludes: Compiler binary omitted for security
Guide: Web Setup Guide (/setup)
  • Deliver to clients for rapid VPS / Server deployment
  • UTF-8 certified, zero encoding corruption
  • Includes command to query hardware Machine ID for licensing
Download Client Loader (14MB)
protect.txt Setup Guide
Cross-Platform Distribution

Cross-Platform Elite PHP Code Encoder Binaries

All binaries are compiled natively, fully self-contained, and hardened with military-grade Native Code Virtualization. Zero loose scripts, zero plaintext leak.

phpQ.exe

Win64 PE

Elite Encoder CLI & GUI Drag-and-Drop launcher for Windows 10/11 & Windows Server.

  • 1MB In-Memory Anonymous Pipe STDIN streaming.
  • Drag & drop protect.txt directly onto phpQ.exe.
  • Auto-detects bundled PHP or existing XAMPP/Laragon.
  • Hardened with Native Code Virtualization.

phpQ

Native ELF

Monolithic command-line executable compiler & project manager for Linux servers.

  • Entire core engine embedded in RAM via memfd_create.
  • Direct project build: phpq protect.txt.
  • Zero external PHP or PEM dependencies.
  • Universal GLIBC 2.14+ compatibility (CentOS 7 to 9, Ubuntu).

phpQ-nts.so

NTS Loader

Universal Non-Thread-Safe runtime loader for PHP-FPM, Apache, Nginx, and CLI.

  • Single universal binary for PHP 7.3 through 8.4.
  • 100% statically linked OpenSSL libcrypto.a & libz.a.
  • Dynamic Zend ABI runtime adaptation.
  • Hardened with Native Code Virtualization.

phpQ-ts.so

TS Loader

Thread-Safe (ZTS) runtime loader designed for multi-threaded architectures (Apache Event, Swoole).

  • Engineered for ZEND_ENABLE_ZTS=1.
  • Thread-safe global storage isolation (TSRM).
  • Hardened with Native Code Virtualization.
  • Zero OS library conflict.
Defense-in-Depth

Elite Multi-Tier Cryptographic Architecture

Every encoded script benefits from multiple independent layers of cryptographic and bytecode transformation.

AES-256-GCM Authenticated Encryption

Military-standard authenticated symmetric cipher guaranteeing both confidentiality and tamper detection. Modifying a single bit invalidates the payload.

ECDSA P-256 Asymmetric Licensing

Independent web.lic license files signed using elliptic curve cryptography. Only your private key can issue licenses; the loader only embeds the public key.

Multi-Pass AST Obfuscation

Abstract Syntax Tree scrambling, variable renaming, and constant encryption dismantle human-readable code flow before bytecode compilation.

Hardware Machine ID Interlocking

Lock scripts or licenses to unique server CPU, motherboard, and disk fingerprints. Prevents copying to unauthorized cloud instances or VPS servers.

Expiration & NTP Anti-Rollback

Fixed or relative time expiration with optional multi-server NTP synchronization to prevent attackers from bypassing licenses by modifying system clocks.

Native Code Virtualization & Hardening

The entire encoder and loader binaries are virtualized into custom bytecodes at machine-code level, making reverse engineering with IDA Pro, Ghidra, or GDB practically impossible.

Competitive Benchmark & Comparison

Enterprise Comparison: phpQ vs. ionCube, SourceGuardian, PHPDefender & Others

Comprehensive technical assessment of protection architecture, anti-decompilation resilience, modern PHP 8.x support, licensing independence, and lifetime ownership cost across market solutions.

Swipe horizontally to view full matrix
Scroll →
Evaluation Metric
phpQ Encoder RECOMMENDED #1
Elite PHP Code Encoder 2026
ionCube
PHP Encoder v13/14
SourceGuardian
PHP Encoder v14/15
PHPDefender
PHP Defender v3/v4
PHP Bolt / Others
phpBolt, Swoole, Yakpro...
Core Security Engine
Anti-Decompile & Reversing Architecture
Native Code Virtualization + AES-256-GCM
x64 Machine-code virtualization, Cryptographic Interlocking State Token preventing RAM dumps 100%. Zero temp files written to disk.
Custom Bytecode Container
Proprietary opcode container format, but multiple commercial online decompiler services and automated unpackers exist.
Opcode Obfuscation
Bytecode encryption with C loader. Vulnerable to memory hooking on zend_compile_string to extract opcodes from RAM.
AST Flattening & Scrambling
Control-flow flattening with switch-dispatch loops and optional Pd Loader. Lacks machine-code virtualization; vulnerable to AST de-flattening.
Extension Decryption / Obfuscators
PHP Bolt uses static AES keys in C extension (bolt.so). Swoole Compiler targets Swoole async. Yakpro/FOPO use trivial eval base64.
Anti-Decompile Immunity
Automated Decoder Resistance
100% Decompiler-Proof
Zero automated decompilers exist. Instruction virtualization and dynamic opcode scrambling cause automated decompiler bots to crash with fatal syntax errors.
Highly Compromised
Commercial online decompiler services publicly advertise automated ionCube v10–v13 decoding for – per file with high recovery fidelity.
Partially Compromised
Automated unpackers and memory hooking utilities (such as unguard / SG-decode scripts) can extract raw opcode streams from process memory.
Moderate Risk (20% Immunity)
Loaderless scripts are easily reversed by standard AST parser engines. Loader mode can be captured by dumping opcodes at Zend engine compile boundaries.
Zero Resistance (0% – 5%)
PHP Bolt files can be bulk decrypted once the AES key is dumped from bolt.so. Free obfuscators (Yakpro/FOPO) are decoded in under 5 seconds.
Reverse Engineering Difficulty
Time, Expertise & Cost to Reverse
Maximum / Impractical (>12–24 Months)
Requires world-class x64 binary reverse-engineers utilizing custom symbolic execution engines. Thousands of virtualized execution paths render reverse engineering economically unfeasible.
Low – Moderate (Minutes to Hours)
Standard Zend VM opcode structures allow rapid recovery using automated online tools or known opcode signature extraction tools.
Moderate (Hours to Days)
Hooking the loader binary in a debugger allows dumping decrypted Zend op_arrays, enabling reconstruction of logic within hours to days.
Low – Moderate (1 – 8 Hours)
Automated AST de-flattening scripts reconstruct the original control flow graph without needing deep assembly knowledge.
Trivial (5 Mins to Seconds)
PHP Bolt AES keys are recovered in ~5 minutes via binary analysis. Pure obfuscators take ~10 seconds using beautifiers.
Latest PHP 8.x Compatibility
Support for cutting-edge runtimes
PHP 8.0 • 8.1 • 8.2 • 8.3 • 8.4
Universal Runtime ABI Adapter automatically binds to server Zend engine structures dynamically without recompiling loaders.
Delayed Updates
Historically requires 6–18 months after major PHP releases for compatible loaders. Frequent segmentation faults on PHP 8.2/8.3.
Supported (v14/15)
Supports PHP 8.0–8.3, but requires purchasing expensive annual license upgrades to unlock newer PHP minor versions.
PHP 8.0 – 8.2 (Partial 8.3)
Loaderless mode runs on modern PHP, but advanced PHP 8.2+ features (readonly classes, intersection types) can cause parser conflicts.
Fragmented / Outdated
phpBolt requires manual C compilation. Zend Guard abandoned at PHP 5.6/7.0. Nu-Coder stopped at legacy PHP.
Licensing & DRM Enforcement
Cryptographic locks & node binding
100% Offline Cryptographic Licensing
Offline ECDSA P-256 asymmetric licenses (web.lic). Cryptographically locks to Hardware Machine ID, IP, Domain, Expiration without phone-home dependencies.
Traditional Server Locking
Domain, IP, and MAC locking supported, but requires desktop encoder license manager to generate license files.
Locking & Online Checks
Supports domain, IP, MAC address, and optional online licensing server checks (introduces phone-home vulnerability).
Script-Level Checks
Domain, IP, and timestamp validation. Vulnerable to crack patches because licensing conditions are evaluated within standard PHP AST.
Basic / Server-Bound
phpBolt checks domain/key in extension. Zend Guard had classic XML licenses. Obfuscators offer zero cryptographic license verification.
Operating System Platforms
Deployment flexibility & architectures
Windows & Linux (x64)
Native Windows x64 DLL (phpq.dll / php_phpq.dll) and Linux x64 (.so) loaders with zero external dependencies. NTS & TS certified.
Multi-Platform
Wide OS support (Linux, Windows, macOS, FreeBSD), but requires separate loader binaries per OS and PHP version.
Multi-Platform
Supports Linux, Windows, macOS, and FreeBSD loaders.
Windows & Linux
Encoder runs on Windows GUI/CLI. Web server requires loader extension or runs loaderless across standard PHP hosts.
Linux Focused
phpBolt is mainly built for Ubuntu/CentOS Linux. Windows DLL compilation is rarely provided or unstable.
Anti-Debug & Anti-Tamper
Resistance to active debugging & patching
Military-Grade Active Tamper Defense
Direct x64 hardware ptrace/IsDebuggerPresent detection, anti-hooking hooks, memory CRC32/SHA-256 checks, and immediate process termination on tamper.
Loader-Level Checks
Basic anti-tamper checksums on encoded files, but easily bypassed via debugger breakpoints on loader entry points.
Loader Tamper Checks
Verifies file checksums. Can be bypassed if attacker hooks Zend engine compile hooks.
PHP-Level Anti-Tamper
Includes file integrity hash checks and basic anti-debugging functions, but vulnerable to runtime memory patching via APM or Xdebug.
Minimal to None
No anti-debugging or binary integrity checks in PHP Bolt. Obfuscators have zero tamper resistance.
Execution Speed & Performance
Impact on website response time
Near Zero Overhead (<1%)
Direct in-memory Zend Op Array deserialization. 100% compatible with OPcache & JIT Compiler.
Good
Good OPcache support, but loaders have a noticeable memory footprint and initialization overhead.
Acceptable
Reasonable execution speed, compatible with standard OPcache caching.
15% – 30% Overhead
Control-flow flattening loops and dynamic string decryption in loaderless mode increase CPU cycles and memory usage.
Severe Latency
Repeated eval() calls and un-cached file decrypts reduce application speed by 200% – 500% with high server loads.
Total Cost of Ownership
Pricing model & update policy
Lifetime Ownership
Unlimited projects and domains. Zero recurring annual fees. Complete Windows + Linux suite included.
99 – 99 / Year
Mandatory recurring subscription fees to encode for newer PHP releases. Expensive over time.
50 – 50 + Annual Fees
Annual maintenance fees required after 12 months for updates. Tiered limitations by edition.
29 – 99 / License
Commercial license with tiered features (Loaderless vs Pro). Renewal fees for newer versions and updates.
Free / 00+ (Swoole)
phpBolt is free but unmaintained. Swoole Compiler charges heavy per-server recurring licenses.
DECOMPILATION & REVERSING BARRIER BENCHMARK

Anti-Decompile & Reverse Engineering Difficulty Matrix

Independent comparison of decompiler immunity, reverse engineering resistance, and adversarial crack time across 5 solution classes.

Immune
Moderate
Vulnerable
RECOMMENDED #1
phpQ Encoder
Decompile Immunity: 100% (Immune)

0 automated decoders exist. Decompiler services fail with fatal parsing errors.

Reversing Difficulty: Maximum

Estimated >12–24 months. Virtualized CPU machine code execution renders decompilation unviable.

Time-to-Crack: >1 to 2 Years
Attacker Skill: Elite Cryptanalyst
Decompiler Cost: bash (Impossible)
ionCube
Decompile Immunity: 15% (Vulnerable)

Automated decoder web services (EasyToYou, IDA loader scripts) decompile routinely.

Reversing Difficulty: Low – Moderate

Standard Zend opcode structure allows rapid recovery of control flows and functions.

Time-to-Crack: 5 – 30 Minutes
Attacker Skill: Script Kiddie / Bot
Decompiler Cost: – / file
SourceGuardian
Decompile Immunity: 35% (Moderate)

Memory hooking tools hook into Zend compile functions to extract opcode streams.

Reversing Difficulty: Moderate

Requires capturing memory dumps and manual CFG (Control Flow Graph) reassembly.

Time-to-Crack: 2 – 48 Hours
Attacker Skill: Intermediate Reverser
Decompiler Cost: 0 – 0 / file
PHPDefender
Decompile Immunity: 20% (Moderate)

AST de-flatteners reconstruct switch dispatchers back into original branch logic.

Reversing Difficulty: Low – Moderate

Script-level obfuscation allows symbolic simplification without binary disassemblers.

Time-to-Crack: 1 – 8 Hours
Attacker Skill: AST / Python Script
Decompiler Cost: – 0 / file
Bolt & Obfuscators
Decompile Immunity: 5% (Trivial)

phpBolt AES keys extracted in Ghidra; free obfuscators decoded in 10 seconds.

Reversing Difficulty: Trivial

Hooking eval() dumps source code instantly. Zero virtual machine protection.

Time-to-Crack: < 5 Minutes
Attacker Skill: Entry Developer
Decompiler Cost: bash (Free Scripts)
Ecosystem Architecture Audit

Deep Technical Breakdown: phpQ vs. Alternative PHP Encoders

Understand how each solution works internally, their underlying cryptographic models, and why alternative tools remain susceptible to reverse engineering.

AST Obfuscator + Loader

PHPDefender (PHP Defender)

Employs Abstract Syntax Tree (AST) control-flow flattening, string scrambling, and optional Pd Loader or loaderless deployment.

Mechanism: Switch-case dispatch loops & base64/gzip eval.
Vulnerability: Because it operates within standard PHP AST without CPU virtualization, symbolic execution tools and AST traversers (like nikic/php-parser) can de-flatten the switch loops back into original if/else conditions.
→ Good for low-risk shared hosting; inadequate for enterprise IP.
C Extension Decryption

PHP Bolt (phpBolt)

A lightweight C extension (bolt.so / bolt.dll) providing runtime AES-256 decryption functions before executing PHP scripts.

Mechanism: Hooked Zend compile with symmetric key AES.
Fatal Flaw: The AES encryption key is statically embedded in the C extension binary. Opening bolt.so in Ghidra or IDA Pro exposes the key within 5 minutes, allowing automated bulk script decryption.
→ Lightweight & free, but trivial to bypass with basic disassemblers.
Async Engine Compiler

Swoole Compiler (Shiwo Tech)

Compiles PHP source code into custom binary bytecode specifically tailored for high-concurrency Swoole asynchronous microservices.

Strengths: Strong opcode-level protection inside Swoole event loops.
Limitations: Extremely expensive per-server recurring subscription model (00+/server/yr), strictly tied to the Swoole async engine, and incompatible with standard Nginx + PHP-FPM architectures.
→ Enterprise async specialist; locked ecosystem and high ongoing cost.
Legacy Bytecode Encoder

NuSphere Nu-Coder

Traditional commercial PHP bytecode compiler developed by NuSphere for the PhpED development environment.

Mechanism: Precompiled Zend bytecodes with loader extension.
Status: Mostly stagnant development. Lacks modern PHP 8.2–8.4 typed properties, union types, and OPcache JIT acceleration features.
→ Legacy enterprise tool; incompatible with cutting-edge PHP 8 stacks.
Discontinued / EOL

Zend Guard (Zend Technologies)

The pioneer commercial PHP encoder from the creators of the Zend Engine, officially discontinued after PHP 5.6 / 7.0.

History: Protected enterprise software for over a decade.
Current State: Completely End-of-Life. Zero support for PHP 7.1 through PHP 8.4. Legacy files are routinely decompiled by automated tools like DeZend.
→ Dead technology; cannot run on any modern production server.
Source Scramblers

Yakpro-PO & Free Obfuscators

Free open-source scripts that rename variables to unreadable strings, strip whitespace, and wrap code in eval(base64_decode()).

Security Level: 0% protection against reverse engineering.
Trivial Deobfuscation: Overriding eval() with var_dump() or running standard beautifiers restores clean, readable source code in under 10 seconds.
→ Minification only; zero intellectual property protection.

Absolute Anti-Decompile

Unlike ionCube or SourceGuardian where automated online decompiler services exist, phpQ shields your intellectual property with Native Code Virtualization and AES-256-GCM. Core decryption and op_array deserialization logic is virtualized at the CPU machine-code level, completely thwarting automated decompilation tools.

Universal ABI: Future-Proof PHP

Eliminate the frustration of waiting months for third-party encoder updates when new PHP versions launch. phpQ dynamically binds to server Zend engine ABI structures, delivering seamless compatibility across PHP 8.0 through PHP 8.4 without swapping loaders.

100% Offline Licensing

Independent web.lic licenses leverage military-grade ECDSA P-256 asymmetric cryptography (NIST standard). Cryptographically locks to server Hardware Machine IDs, IP addresses, and domains without phone-home dependencies or telemetry, ensuring total client privacy and reliability.

Visual Proof

Source Code Inspection: Plaintext vs. Encrypted Container

BEFORE: Plaintext PHP

0% PROTECTED

Original business logic, database passwords, and licensing checks visible to anyone with server read access:

<?php
class PaymentService {
  private $apiKey = "sk_live_9a8b7c6d5e4f3a2b1c";
  public function processOrder($orderId, $amount) {
    // Vulnerable: Client can patch or remove this check!
    if (!$this->verifyLicense()) {
      throw new Exception("License expired!");
    }
    return $this->chargeCard($amount);
  }
}

AFTER: phpQ Hardened Container

100% HARDENED

Authenticated binary container decoded exclusively in RAM by the native Virtualized Loader:

<?php
if (!extension_loaded('phpq')) { exit(1); }
return phpq_load(__FILE__);
__halt_compiler();
UFA4WAABAABERUZBVUxUX1BST0pFQ1QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
K2Emgh064RCBNWgPumpSeYQa0ff0sAK5QQGFeYABAAB4AwAArLTQO+TAOW4rkjjZ6omcTNgYTwcD...
80eI/jIMkTSzpIms+Ff7kw9qA8tpx9yC7SBFnOG7nXQ8Taj4Pmz7eI8zxF82mmnZNWg+GtIvYT3B...
Universal Compatibility

Supported Operating Systems & Runtimes

Full cross-platform support for modern Windows and Linux ecosystems.

Operating System Matrix

Platform Versions Support
Windows Windows 10 / 11, Server 2016 - 2025 (x64) Native Portable
Ubuntu 20.04, 22.04, 24.04 LTS (x64) 100% Certified
RHEL / CentOS CentOS 7, 8, 9 Stream, AlmaLinux, Rocky 100% Certified
Debian Debian 10, 11, 12 (Buster to Bookworm) 100% Certified

PHP Version Support

PHP Version Zend Engine API Compatibility
PHP 8.4 20240924 Supported
PHP 8.3 • 8.2 • 8.1 • 8.0 20230831 - 20200930 Supported (Standard)
PHP 7.4 • 7.3 20190902 - 20180731 Supported
Rapid Deployment

Installation Guide

Simple, rapid setup whether you develop on Windows or deploy on Ubuntu Linux servers.

Windows Quick Start Guide

1. Extract phpQ Windows Portable:

Download phpQ-windows-portable.zip and extract to any destination directory.

2. 1-Click Encoding or Drag & Drop:

• Drag and drop your protect.txt directly onto phpQ.exe
• Or double-click example_Run_Project_Encode.bat

3. Production Output:

All compiled, hardened PHP scripts are generated securely inside dist_protected\.

Ubuntu Linux Server Setup Guide

1. Install Loader to System Library:

sudo mkdir -p /usr/local/lib/phpq
sudo cp phpQ-nts.so /usr/local/lib/phpq/
sudo chmod 755 /usr/local/lib/phpq/phpQ-nts.so

2. Register PHP Extension (phpenmod):

PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')
sudo bash -c "echo 'extension=/usr/local/lib/phpq/phpQ-nts.so' > /etc/php/$PHP_VER/mods-available/phpq.ini"
sudo phpenmod phpq

3. Restart Web Server & Verify:

sudo systemctl restart php$PHP_VER-fpm # or: sudo systemctl restart apache2
php -m | grep phpq # Module 'phpq' confirms successful activation!
Open Complete Dedicated Installation Guide (/setup)
Developer Manual

Command-Line CLI Workflows

Same commands work identically on Windows (phpQ.exe) and Linux (phpq).

1. Build Project (Recommended)

Reads protect.txt configuration to compile full solutions:

phpq protect.txt
# On Windows:
phpQ.exe protect.txt

2. Rapid Single-File Encoding

Quickly encode individual scripts without a project file:

phpq encode -i index.php -o index_enc.php
# Enable AST scrambling:
phpq encode --obfuscate -i app.php -o app_enc.php

3. Issue Offline License

Generate signed web.lic locking domain & expiration:

phpq license --project-id "MY_APP" \
  --project-key "SECRET_KEY" \
  --domain "client.com" \
  --expire "2027-12-31" -o web.lic
Open Complete Dedicated Usage Manual (/guide)