Minify JavaScript without uploading your source

The file being minified is somebody's product, and frequently somebody else's product under an agreement that says where the source may and may not go. Working source is candid in a way shipped source is not: comments name people, ticket numbers and the reason a workaround exists, and internal hostnames sit in plain strings waiting to be read. That is an argument for the minifier not being a network service, quite apart from how careful the code is.

The limit worth stating is that minified code is still code. Strings survive because the program needs them, so an endpoint URL is just as visible after minification as before, and a key committed into a front-end file is exactly as exposed. Shortening variable names makes reading less pleasant; it does not make anything secret.

Test what comes out. Code that depends on how it was written, on a function's own name for example, can behave differently once names are shortened, and the failure usually appears somewhere unrelated. Minify as a build step against a readable source you keep, never as an edit to the only copy you have.

Verify the source stayed local by pasting it in with the network disconnected. Text in, shorter text out, no server involved. For code you are contractually not allowed to disclose, that is the difference between a routine optimisation and a breach nobody would ever have noticed.