For Developers · Panda-K
Panda-K: Balanced & Max
Choose the dashboard protection level, understand its performance cost, and add function-level policies where you need them. This reference describes Panda 3.5.0 and macro API 2.
Start with Balanced
Select Panda-K as the obfuscator in the upload or edit form, then choose Balanced. Test the protected script in your actual runtime before distributing it. Try Max after the Balanced build works and you have measured its startup time and frame-time cost.
Both choices compile your script into Panda's custom VM. Macros are available in both; Max is not required to use them. Changing a preset requires a new obfuscation build.
Continue with Macro Documentation or Platform Support: Roblox, Luau & Lua.
Balanced versus Max
The dashboard labels are mapped to engine presets as follows. The dashboard's Balanced is the compatibility-focused option; it is different from the engine profile named balanced.
| Detail | Balanced | Max |
|---|---|---|
| Dashboard setting | RECOMMENDED | MAX_COMPATIBLE (legacy internal name) |
| Engine preset | Panda-Xenon | Panda-Roblox-Strong |
| Engine profile | max-perf | max-security |
| Best fit | First build, frequent callbacks, mobile or constrained runtimes | Code where additional protection justifies more runtime and output overhead |
| Control-flow flattening | Off by default; can be enabled per function | On for eligible functions |
| Internal VM guards | Off by default | On by default |
| Junk instruction density | 0.05 | 0.40 |
| Ordinary string cache | 48 entries per function | 6 entries per function |
| Lazy image cipher | ChaCha8 | ChaCha20 |
| VM layers | 1 | 1 |
| Macro API | 2 | 2 |
Max means more protection work, not guaranteed compatibility
Engine profiles for direct API users
The self-hosted API also has an intermediate balanced engine profile, selected by Panda-Roblox. It uses flattening, moderate junk and a 16-entry string cache. The dashboard's two-button selector does not expose this as a third choice.
Named presets select protection defaults, not a language. The API's language selection determines Luau or Lua 5.1 parsing. A preset name containing Roblox does not add Roblox services to a standalone Lua runtime.
Tune individual functions
PANDA_PROTECT("strong", function(...) ... end)adds stronger VM guards to a sensitive function, including when the build default disables them.PANDA_PROTECT("minimal", function(...) ... end)disables flattening, junk, opaque predicates and guards for that function. It remains virtualized.PANDA_NO_VIRTUALIZE(function(...) ... end)emits readable Luau for a measured performance hotspot. This removes VM protection for that function and is a separate decision from choosing Balanced.
Function policies normally pass to child functions unless the child overrides them. Avoid conflicting wrappers. See the macro reference for supported arguments and restrictions.
Before reporting a failed build
- Submit the script contents or a script file. A URL by itself is not Lua source.
- Fix the reported source line first: unexpected Unicode in code, an extra
end, deep expression nesting and Luau's 200-local limit cannot be fixed by switching presets. - For a timeout, test Balanced and reduce expensive generated code. Request-size and worker-memory limits are separate from preset strength.
- When contacting support, include the preset, target runtime, error and request ID if available. Include a small reproduction rather than account tokens.