How to Decode a Python Marshal Loader and Recover the Source

The word "encryption" implies a secret key. A marshal loader has none. marshal.dumps() serialises a compiled code object to bytes; base64 makes those bytes printable; zlib or zstd optionally shrink them. The loader simply reverses that chain at import time and hands the code object to exec(). Anything needed to run the code has to ship inside the file — so anyone can run the same reversal without a password.

A loader is a nested set of calls you unwrap from the inside out. The shape is always some combination of these:

import marshal, zlib, base64
exec(marshal.loads(zlib.decompress(base64.b64decode("<base64 payload>"))))

1. base64-decode the string inside b64decode(...) back to raw bytes.
2. decompress those bytes if the loader wraps them in zlib.decompress(...) or zstd.decompress(...). (zstd only exists in the stdlib on Python 3.14+.)
3. `marshal.loads` the result to get the original code object back — no key, nothing to guess.

The tool reads the actual call chain rather than guessing, so it handles aliased imports (from base64 import b64decode as d) and won't be fooled by a comment that claims a different codec. It never runs your code — it stops at marshal.loads, which deserialises without executing.

Once you have the code object, dis shows the bytecode. For a tiny greet() module the disassembly starts like this — the function and the string constants are already in plain view:

RESUME                   0
LOAD_CONST               0 (<code object greet ...>)
MAKE_FUNCTION
STORE_NAME               0 (greet)
LOAD_NAME                1 (print)
PUSH_NULL
LOAD_NAME                0 (greet)
LOAD_CONST               1 ('pyobfuscate')
CALL                     1

To go all the way back to source, rebuild a .pyc from the code object and run it through a decompiler (the tool uses pycdc, compiled to WebAssembly). How well that works depends entirely on the Python version, because a code object's format changes between releases:

Here's why "marshal encryption" is a poor place to hide anything. Decode a loader whose code checks a licence, decompile it, and the hard-coded key is right there in the recovered source — this is genuine pycdc output from a compiled sample:

import sys
API_KEY = 'sk-9f3a-PRO-2026'
VALID_CODES = {'PRO-2026-XYZ', 'TRIAL-7788'}

def main():
    if len(sys.argv) < 2:
        print('Usage: app.py <license-code>')
        sys.exit(1)
    code = sys.argv[1]
    if code in VALID_CODES:
        print(f'Licensed. key={API_KEY}')
    else:
        print('Invalid license key')
        sys.exit(1)

The API key, the valid codes, and the exact check all came back. Marshalling changed how the file *looked*, not what it *contained*.

Marshalling is a light deterrent — fine for keeping casual eyes off a script, useless against anyone who knows the three steps above. If you're shipping Python you care about, layer real measures instead of relying on encoding:

• Obfuscate the source first (rename identifiers, encrypt strings, hide imports) so even recovered bytecode is hard to read — see the Python obfuscator.
• Move any licence or trial check off the client. A check baked into the code can be found and patched once decoded; a server-side check with signed, device-bound responses survives being unmarshalled. That's what a system like Licers does.

To try the decode yourself, paste a loader into the Marshal Decrypt tool — it runs entirely in your browser. To go the other way, the Marshal Encryptor builds these loaders, and how Python marshal works covers the format in depth.