Closures and Data Privacy in JavaScript

Closures and Data Privacy in JavaScript

JavaScript does not have private variables on objects (until very recently with #private fields). Closures provide a way to create truly private state.

The Basic Pattern

function createCounter() {
  let count = 0;
  return {
    increment: () => ++count,
    decrement: () => --count,
    getCount: () => count,
  };
}
const counter = createCounter();
counter.increment();
counter.increment();
counter.getCount(); // 2
// count is not accessible directly:
counter.count; // undefined
``
`count` is inside `createCounter`'s lexical environment. The returned methods close over it. The outside world can only interact with `count` through the methods.

### The Module Pattern

```js
const myModule = (function () {
  const privateVar = "secret";
  function privateMethod() {
    return privateVar.toUpperCase();
  }
  return {
    publicMethod: () => privateMethod(),
    publicVar: "public",
  };
})();
myModule.publicMethod(); // "SECRET"
myModule.privateVar;     // undefined
myModule.privateMethod;  // undefined
``
An IIFE creates a private scope. Only the returned object is accessible. This was the standard way to achieve modules before ES6.

### Encapsulation

Closures provide **encapsulation**: hiding internal state and exposing only a controlled API. This is the same principle as private methods in classes:

```js
class Counter {
  #count = 0; // truly private field (ES2022)
  increment() { return ++this.#count; }
  getCount() { return this.#count; }
}
``
`#private` fields are the modern way. Closures are the classic way.

### Data Hiding

```js
function createUser(name) {
  let password = "default";
  return {
    getName: () => name,
    setPassword: (newPwd) => { password = newPwd; },
    authenticate: (pwd) => pwd === password,
  };
}
const user = createUser("Kunal");
user.password;        // undefined (hidden)
user.authenticate("default");     // true
user.authenticate("wrong");       // false
``
`password` is completely hidden. It can only be set via `setPassword` and checked via `authenticate`.

### Advantages

- **True privacy**: variables cannot be accessed or modified from outside.
- **Controlled access**: only the returned API can interact with the state.
- **No naming collisions**: each closure has its own private scope.

### Disadvantages

- **Memory**: closed-over variables are not garbage collected until the closure is.
- **Testing**: private state is harder to test (you must go through the API).
- **Debugging**: you cannot inspect closed-over variables directly.

### The Takeaway

Closures provide data privacy by hiding variables inside a function's lexical environment and exposing only a returned API. The module pattern (IIFE) was the classic approach. Modern JS has `#private` class fields, but closures are still widely used for private state.