Flutter obfuscation: what it does and what it does not

Flutter obfuscation replaces class and function names in compiled Dart code with other symbols in release builds. It makes reading harder. It does not encrypt resources, it does not hide strings and the Flutter docs say storing secrets in an app is poor practice. Use it only as light friction.

The flags

The documented approach combines two flags on a release build, plus a directory for a symbols file.

flutter build apk --obfuscate --split-debug-info=out/android

Obfuscation works for release builds on listed targets such as apk, appbundle, ios, ipa, linux, macos and windows. It does not apply to the web, where release builds are minified.

Keep the symbols files

The build writes a symbols file for each platform and architecture. Back it up and tie it to the release it came from. Without it you cannot read stack traces from the field. The docs show the symbolize command for turning a crash trace into readable names, and say that on Windows x64 you get a PDB file that the command does not support, so you use a debugger.

Treat these files as internal. They map obfuscated names back to real ones.

What it does not do

• It does not encrypt resources.
• The docs say it does not protect against reverse engineering in any meaningful sense, because it only renames symbols.
• It does not hide literal strings, keys or URLs.
• Enum names are not obfuscated at present, per the docs.

What can break

Code that depends on names will fail. The docs give an example of comparing a runtimeType string to a class name. Search for runtime type string use, reflection style logic and any analytics keyed on class names before you enable the flag, and run your tests against an obfuscated build.

When it is worth turning on

If you ship a consumer app with proprietary logic you would rather not hand over in readable form, it is a cheap step. Combine it with server side authorization and secrets kept off the device. If your risk is a stolen API key, obfuscation does nothing for you. See how Flutter secure storage behaves by platform for credentials the app must hold.

Try it yourself

Click through it at your own pace, or open it full screen.

Run the scan and look for hardcoded secret findings, which obfuscation would not hide or fix.

Quick check

Sources

• Flutter: obfuscate Dart code

Last reviewed: 19 October 2026.