Hermes compiles your React Native JavaScript to bytecode in release builds, but the documented reason is faster startup. The Hermes page says nothing about security, so do not rely on it to hide logic, keys or endpoints. Plan as if the contents of your app can be read.
What Hermes does
Hermes is the default JavaScript engine in React Native. The docs say that a release build compiles JavaScript to Hermes bytecode at build time, which improves startup on the device, and that the compiled output is an hbc file. Compared with the older engine, it can reduce memory use and app size.
You can check it is active by testing for the HermesInternal global. The docs warn that with unusual bundle loading, the global can exist without bytecode being used.
Why that is not a security feature
The Hermes documentation presents bytecode only as a performance feature. It does not call it obfuscation and does not claim it protects source code. Bytecode is a different format, not an encrypted one. Tools exist that inspect it, and strings in the bundle are still present for anyone who looks. Treat the app package as public.
What this means for your design
- Secrets. Never ship them. The React Native security guide says anyone inspecting the bundle can read keys in plain text. Use a server in the middle.
- Authorization. Do any check that matters on the server. A modified client can skip checks in the app.
- Business logic. If a rival reading it would hurt you, keep that part server side.
- Feature flags and hidden endpoints. Assume users can find them. Protect them with real access control.
If you want a bit more friction
Some teams add obfuscation or tamper detection for apps in high risk categories, like payments or games. These raise cost for attackers but do not stop them. Decide based on your threat model, measure the impact on crash reports, and never use them in place of server side controls. The post on client side checks you must enforce on the server goes deeper.
Quick check
Can I put an API key in the bundle if Hermes compiles it?
No. Compilation does not remove strings and is not meant to protect them. Keep the key on a server.
Sources
Last reviewed: 19 October 2026.
