Can Python Code Be Decompiled? What You Actually Need to Know

"Decompiling" means recovering readable source (or at least the logic) from a distributed program. In Python it ranges from *trivial* to *very hard* depending on format:

Here's the program I used to test each row — a hard-coded key and a license check, the thing people most want to hide:

API_KEY = "sk-live-9f83kd02n"
def check(key):
    return key == "PRO-2026-XYZ"
print(check("PRO-2026-XYZ"))

Shipping .pyc instead of .py is the most common "protection" — and it's barely any. Compiling secret.py produced a 371-byte .pyc. Before decompiling anything, a plain byte search pulls the secrets straight out:

$ grep -a -o "sk-live-9f83kd02n" secret.pyc
sk-live-9f83kd02n

And the built-in dis module reads the logic right off the .pyc's code object — the key, the function, the comparison, all in plain sight:

1   LOAD_CONST   0 ('sk-live-9f83kd02n')
    STORE_NAME   0 (API_KEY)
2   LOAD_CONST   1 (<code object check ...>)
    MAKE_FUNCTION
    STORE_NAME   1 (check)
4   LOAD_NAME    1 (check)
    LOAD_CONST   2 ('PRO-2026-XYZ')

On top of that, decompilers rebuild actual .py source: uncompyle6/decompyle3 for older versions, pycdc for 3.10+. Our free .pyc Decompiler runs pycdc in your browser — paste a .pyc and watch source come back. So: .pyc is a performance cache, never protection. (Full breakdown: can you decompile a .pyc file?)

Obfuscation is the honest middle ground. It keeps the code as runnable Python but strips the clues: renames every identifier irreversibly, encrypts string literals so a byte search finds nothing, flattens control flow into a state machine, and injects junk. A decompiler still "works" — but what it recovers is the obfuscated mess, not your original code. The goal is economic: make reverse engineering cost more time than your logic is worth.

This is the strongest client-side option. Compiling to a native `.pyd`/`.so` with Cython turns your Python into machine code — there's no bytecode left, so .pyc decompilers have nothing to work with. When I tried to load my compiled module as a code object, it simply isn't one:

>>> import marshal
>>> marshal.loads(open('liccore.cp311-win_amd64.pyd','rb').read()[16:])
ValueError: bad marshal data   # it's native machine code, not a Python code object

…is code you never ship. If your sensitive logic — the pricing algorithm, the license validation, the model — runs on your server and the client only sends inputs and receives outputs, there's nothing on the user's machine to decompile. This is the one form of protection that's absolute, and it's why serious products keep their crown-jewel logic server-side and treat client obfuscation as a delay tactic for the rest.

Practical takeaway: layer it. Obfuscate what must ship (raises cost), compile the sensitive modules to native code (removes bytecode), and keep real secrets off the client entirely (removes the target). See the full playbook in how to protect Python source code.