CLI Reference

The examples here use the p4j command that the installer provides. On Windows the GUI is installed from the .exe, and on macOS from Protector4J.app inside the .dmg; how the GUI was installed does not change the CLI syntax below. If the installer did not put the CLI on your PATH, run it from the command-line entry point in the Protector4J installation directory.

p4j --help

1. Commands

p4j encode     <input.jar> <output.p4jx|output.jar> [options]
p4j javaapp    <input.jar> <output-dir> [options]
p4j springboot <input.jar> <output-dir> [options]
p4j tomcat     <input.war> <output-dir> [options]

The low-level encode also works with the command name left out:

p4j input.jar output.p4jx [options]

Launch-level options choose the packaging target. They can go before the command name, or together at the very end of the command line — the command line the GUI exports uses the trailing form.

For example:

p4j --java-version 21 --target-platform linux-x64 springboot app.jar dist
p4j springboot app.jar dist --java-version 21 --target-platform linux-x64

These two commands are equivalent. Launch-level options cannot be mixed in among the packager options — there they are read as unknown packager options and the command fails.

2. Common options

Supported by the higher-level packaging commands:

3. encode

p4j encode input.jar output.p4jx [options]

--bind-launcher and --launcher-sha256 cannot be used together.

4. javaapp

p4j javaapp input.jar output-dir [options]

5. springboot

p4j springboot input.jar output-dir [options]

6. tomcat

p4j tomcat input.war output-dir [options]

7. Windows EXE options

javaapp, springboot, and tomcat can build an additional native Windows launcher. The target platforms must include windows-x64, windows-x86, or windows-aarch64.

Any --exe-* option turns on EXE generation by itself. In a multi-platform task, only the Windows packages get an EXE; the others are built as usual and keep their startup scripts.

p4j --target-platform windows-x64 javaapp app.jar dist --windows-exe --exe-name MyApp.exe --exe-mode gui

For the full instructions, runtime behavior, and code signing steps, see Create a Windows EXE Launcher.

8. Rule syntax

com.example.SecretService   a single class
com.example.service         this package only
com.example.service.*       this package only
com.example.service.**      this package and all its sub-packages
com/example/Secret.class    a class entry path

Separate several rules with commas. Quote any rule containing * so the shell does not expand it:

--protect 'com.example.**' --exclude 'com.example.dto.**,com.example.config.**'

9. Environment variables

Environment variables suit shared defaults for a CI job, a container, or several commands run in sequence. When you need a single packaging run to be recorded and reproducible, pass the values explicitly as CLI options instead.

When a variable and its CLI option are both set, the explicit CLI option wins. The environment variables remain fully supported, so existing automation scripts keep working.

For example, to set a common target for several packaging commands in the current shell:

export P4JX_RUNTIME_JAVA_VERSION=21
export P4JX_RUNTIME_PLATFORM=linux-x64

p4j springboot service-a.jar release/service-a
p4j springboot service-b.jar release/service-b

The Java system property equivalents suit advanced cases where you launch the packager JAR directly:

-Dp4jx.runtime.java.version=<N>
-Dp4jx.runtime.platform=<platform>
-Dp4jx.runtime.cache.dir=<dir>

10. Automation example

p4j --java-version 21 \
  --target-platform linux-x64 \
  springboot build/app.jar release/linux-x64 \
  --compat-apply \
  --protect 'com.example.service.impl.**' \
  --exclude 'com.example.dto.**,com.example.config.**' \
  --jvm-option -Xms1g \
  --jvm-option -Xmx2g \
  --app-id com.example.app

Explicit protection, exclusion, and layout options override the automatic recommendations. Record the final options, the SHA-256 of the input, and the tool version as part of your release provenance.

For GUI and CLI examples, and for editing run.sh, run.bat, the Tomcat startup scripts, and Windows PowerShell, see JVM Startup Options.