If I were you, I'd have a look at Cryptopad 3.10 and see how the author does things. For instance, he does NOT store passwords in his script, and therefore has no need to obfuscate the source.