This seems like a pure theater, which provides no functional security? Surely human will simply use a debugger. Open inspector and find the object in DOM. Or o

This seems like a pure theater, which provides no functional security? Surely human will simply use a debugger. Open inspector and find the object in DOM. Or open JS console and find it using a single command. Not to mention that "difficulty level" thing is pretty absurd too. Your main protection is obscurity - the idea is that humans won't look at DOM. For that, you don't need multiple operations, just put it in any random attribute or a JS comment. Maybe add 1 operation like "base64" for the happiness. (If this is a joke, please disregard the message above)