Is proguard capable to obfuscate logger messages?

Issue

I used proguard to obfuscate a jar and after research the resulting jar it was found that it didn't obfuscate logger messages which I probably would like to do.

How to do it with proguard? I used gui based tool with allmost default settings.

original class

logger.info("value encrypted");

after proguard and decompiled

this.c.info("value encrypted");

Solution

The simple answer is that ProGuard does not do this.

And relatedly, ProGuard will not obfuscate constant strings in your code either; see Does proguard work to obfuscate static string constants?.

The best things I can suggest are:

1. Turn off logging in your release version.
2. Log to Crashlytics so that the end users don't to get to see the log messages on their devices.
3. Implement a custom LogFormatter that obfuscates the log messages on the fly. (It could do it for all log messages, or just for log messages that match particular patterns.)
4. If you are actually trying to obfuscate the log message strings embedded in your code, there are alternatives to ProGuard that will do that; see the Q&A link above for some leads.

Answered By - Stephen C