I think the first response answered the wrong question?

I think a more precise reading of your question was that you want to hide all source code from the sysadmins of the web app server, where the web app is to be deployed, right? ("my client" == owner of web app server host?)

You could pre-compile all your JSP's, and only supply the compiled .class files, if you can figure out how to do that in your development environment.

But then someone can still use "javap" to disassemble any .class file into a .java source file. I have heard there are some kind of obfuscators around which make the resultant .java file a lot harder for humans to read (search the FAQ's here for lots of references).