How to protect C# source code from being decompiled

If you ship a C# application, you’re shipping something very close to your source code. This post explains why, and what you can actually do about it.

Why compiled C# is so readable

C# compiles to IL, a bytecode that keeps your type names, method names, and program structure intact. A free decompiler — ILSpy, dnSpy, dotPeek — reads your .dll or .exe and reconstructs near-original C#. Class names, method logic, string constants, even comments-worth of structure: all visible. For a desktop app, a plugin, or an on-prem product, that means your customer already has your source in all but name.

What you can (and can’t) do

You can’t stop code that has to run from ultimately being analyzed — but you can make it expensive and impractical to reverse-engineer, which is enough to protect most commercial software. The tools:

1. Obfuscation

Rewrite the compiled IL so it’s hard to read while behaving identically:

• Identifier renaming removes the meaningful names decompilers depend on.
• Control-flow flattening rewrites methods into state machines, hiding your logic.
• String encryption takes readable literals (keys, endpoints, messages) out of the binary.

2. Anti-tamper and anti-debug

Detect a modified assembly or an attached debugger, so attackers can’t quietly patch or step through your code.

3. Keep real secrets off the client

No amount of obfuscation makes an embedded private key or master credential safe. Anything that must stay secret belongs on your server, behind an API.

4. Licensing + code signing

Node-locked licensing stops a copied binary from being reused; code signing lets users verify the binary is genuinely yours and unmodified.

Doing it in practice

The realistic workflow for a C# project:

1. Build in Release.
2. Run an obfuscator over the output, preserving your public API and any members used via reflection or serialization.
3. Verify the protected build passes your full test suite (behavior must be identical).
4. Sign the output and ship.

Nebula.NET does steps 2–4 for .NET Framework 4.8 and .NET 6–10, via CLI, GUI, and MSBuild/CI, and is tested to preserve runtime behavior. Our step-by-step guide walks through it.

Set the right expectation

Protecting C# source isn’t about making reverse engineering impossible — it’s about raising the cost so far that it’s not worth it for the people who’d copy your work. Combined with licensing and good secret hygiene, that’s exactly the protection most products need. Try it free from the download page.