Why hide strings
Compiled games still carry their text. Run a strings viewer over a Godot pack or a Unity build and you will see URLs, secret codes, unreleased item names and story spoilers sitting in plain sight. Dataminers post these before launch, and cheaters use backend URLs and reward keys they find this way. Scrambling the strings means a quick look or a text search turns up nothing readable, so the easy path is closed.
How it works
Each string is XOR-combined with your key, repeating the key across the bytes, and then written as Base64. The result looks like random text in your source and your build. At runtime the tiny decode function reverses it: Base64 back to bytes, XOR with the same key, and you have the original string. Decoding is fast, so you can call it the moment you need the value and never keep the plain text sitting in a variable longer than necessary.
Using it
Paste the generated block into your project. Call deob(S.api_url) in Godot, Obf.Get("api_url") in Unity, or deob(S.api_url) on the web. Keep the key the same as in the tool. If you change the strings or the key here, regenerate and replace the block.
What it is not
XOR with a fixed key is obfuscation, not security. Someone who reads your code or watches memory can recover the strings. The point is to raise the effort from "open the file" to "reverse engineer the game," which stops the large majority of casual dataminers. For real secrets, use a server the player cannot read.
Is anything uploaded?
No. The scrambling happens in your browser and your strings and key never leave this page.