Private fields & methods

Real privacy for class objects

JavaScript objects are usually open. If an object has a property named balance, other code can read it, write it, delete it, or accidentally overwrite it. Naming it _balance is only a convention: a polite sign that says “please don’t touch.”

A private class member starts with #, such as #balance or #validate(). The # is not part of a string property name. It creates a private name that only code inside the declaring class body can use. Outside code cannot even parse account.#balance.

This lesson connects the privacy patterns you met in Closures, Closure patterns, and WeakMap & WeakSet to the class syntax from Class basics.

Private instance fields are declared in the class body, then each new instance receives its own private slot. Methods in that same class can read and write the slot with this.#name. Private methods and private getters follow the same access rule.

1class BankAccount {2  #balance = 100;3 4  deposit(amount) {5    this.#validate(amount);6    this.#balance += amount;7    return this.balanceLabel;8  }9 10  withdraw(amount) {11    this.#validate(amount);12    this.#balance -= amount;13    return this.balanceLabel;14  }15 16  get balanceLabel() {17    return "₹" + this.#balance;18  }19 20  #validate(amount) {21    if (amount < 0) throw new RangeError("No negative amounts");22  }23}24 25const account = new BankAccount();26// account.#balance is a SyntaxError outside the class.27account["#balance"] = 999; // a normal public property

Try the buttons. The public methods change the real private balance. The Try account.#balance button shows the SyntaxError that our tests prove with a parser. The fake bracket property demonstrates the key distinction: account["#balance"] is just a normal public property whose string key happens to contain a hash mark.

1class BankAccount {2  #balance = 0;3 4  constructor(opening) {5    this.#validate(opening);6    this.#balance = opening;7  }8 9  get balanceLabel() {10    return "₹" + this.#balance;11  }12 13  deposit(amount) {14    this.#validate(amount);15    this.#balance += amount;16    return this.balanceLabel;17  }18 19  #validate(amount) {20    if (amount < 0) throw new RangeError("Amount must be positive");21  }22}23 24const account = new BankAccount(100);Run25account.deposit(25);26console.log(account.balanceLabel);

1class Account { #balance = 100; }2const account = new Account();3account.#balance;

1class Account {2  #balance = 100;3  read(other) {4    return other.#balance;5  }6}7new Account().read({});

static #count belongs to the class itself, not to each instance. Use private static fields for class-wide counters, registries, caches, and helper methods that should not be part of the public API.

1class Vault {2  static #count = 0;3  static #lastId = 0;4  #id;5 6  constructor() {7    Vault.#count += 1;8    this.#id = ++Vault.#lastId;9  }10 11  static get count() {12    return Vault.#count;13  }14 15  get label() {16    return "vault-" + this.#id;17  }18}19 20const first = new Vault();21const second = new Vault();22console.log(Vault.count);23console.log(first.label + ", " + second.label);

The two vault instances have separate private instance IDs, but they share one private static count. Public code can ask Vault.count; it cannot read Vault.#count.

1class BaseVault {2  static #count = 1;3  static readWithThis() {4    return this.#count;5  }6  static readWithName() {7    return BaseVault.#count;8  }9}10class ChildVault extends BaseVault {}11console.log(BaseVault.readWithThis());12try {13  ChildVault.readWithThis();14} catch (error) {15  console.log(error.name + ": " + error.message);16}17console.log(ChildVault.readWithName());

Sometimes you want to know whether a value is one of your class’s instances without reading private data. Inside the class, #balance in value asks “does this object carry the private brand installed by this class?” It returns a boolean and does not open the safe.

1class BankAccount {2  #balance = 0;3  static isAccount(value) {4    return typeof value === "object" && value !== null && #balance in value;5  }6}7 8const account = new BankAccount();Run9const fake = { "#balance": 999 };10console.log(BankAccount.isAccount(account));11console.log(BankAccount.isAccount(fake));12fake["#balance"] = 123;13console.log(BankAccount.isAccount(fake));14console.log(fake["#balance"]);

Private fields also stay out of ordinary reflection. They do not appear in Object.keys, object spread, or JSON.stringify. But if you add a public property named "#balance", that public property is enumerable like any other.

1class Account {2  #balance = 100;3  owner = "Ada";4  label() {5    return "₹" + this.#balance;6  }7}8const account = new Account();9console.log(Object.keys(account).join(","));10console.log(JSON.stringify(account));11account["#balance"] = 999;12console.log(Object.keys(account).join(","));13console.log(JSON.stringify(account));

You already know three ways to hide state. Closures hide variables in a function’s remembered scope. WeakMaps hide data in a side table keyed by objects. Private fields hide state in class instances with syntax the language enforces.

Prefer private fields when you are already designing a class and each instance needs its own protected state. Prefer closures for small factories, function modules, and one-off remembered values. Prefer WeakMaps when you need to attach hidden data to objects you do not control, or when a module-level side table is clearer than changing a class.

Where you’ll use this

Private members are not only for bank accounts. They are useful whenever you need to protect invariants: rules that must stay true for an object to work.

• UI widgets: keep internal DOM references private and expose methods like open() or close().
• Data models: validate writes through methods so impossible states cannot be assigned directly.
• SDK clients: hide retry counters, caches, and normalized configuration.
• Factories: combine private static caches with public factory methods.

Common misconceptions

Key takeaways

• #private names are real private class members, not naming conventions.
• Only the declaring class body can use a private field, method, getter, setter, or static member.
• Outside account.#x and duplicate private declarations are SyntaxErrors; wrong-object private reads are runtime TypeErrors.
• #x in obj checks the private brand without reading the private value.
• Private fields, closures, and WeakMaps are all useful privacy tools; choose by code shape.

Up next: Extending built-ins & instanceof.