PHP Source Encoder / Obfuscator

It can, which is why it defaults to off. It is a whole-file, name-matching heuristic: it renames every bareword occurrence of a declared function/class/interface/trait name, consistently, at the declaration and at call sites. It cannot see through dynamic dispatch - calling a function by a string held in a variable, invoking a variable that holds a callable, instantiating a class whose name is stored in a variable (`new $className()`), or anything reached via Reflection. Leave it off whenever your code uses any of those.

No - this is source packaging / obfuscation-at-rest, not DRM. The generated PHP still needs the secret key at runtime to decrypt and run your code, and anyone with real access to the PHP process that includes this file can, with effort, recover the decrypted source; encryption-at-rest cannot prevent that. If you embed the secret directly in the file instead of reading it from an environment variable, protection is weaker still, since anyone who can read the file can read the key right next to it. For real, professional PHP source protection, use a dedicated commercial product such as ionCube Encoder or SourceGuardian, which protect at the opcode level rather than wrapping source text.

Its own from-scratch scanner: single- and double-quoted strings (including `$var`, `$var[index]`, `$var->prop`, and `{$expr}` interpolation), heredoc/nowdoc (including the PHP 7.3+ flexible indented closing marker), both comment forms (which correctly stop early at a `?>` closing tag, a real PHP quirk), PHP 8 attributes, and the `<?php`/`<?=` tag pair. It never renames superglobals, `$this`, magic methods (anything starting with `__`), namespace declarations, or `use` imports. Class property declarations and constructor-promoted parameters are also always left alone, since PHP accesses a property elsewhere as a bareword `$this->name` that this tool cannot safely rewrite in sync.

Nowhere - it is 32 random bytes from the browser's crypto.getRandomValues, shown to you as 64 hex characters in a comment inside the generated PHP (and in the Secret field if you press Generate) purely so you can save it yourself. DevTools never stores it, so if you lose it before setting it as your environment variable or copying it elsewhere, the encrypted file can never be decrypted again - there is no recovery path.