How to Decompile a Python `.pyc` File (and Why `.pyc` Isn’t Protection)

When Python imports a module, it compiles the source to bytecode and caches it in a .pyc under __pycache__/. The file is a small header (a version magic number + some flags) followed by a single marshal-serialized code object — the same thing the interpreter runs. Crucially, it's not encrypted or minified. It's your program in a slightly different shape.

That matters because "different shape" is not "hidden." Here's the script I compiled:

API_KEY = "sk-live-8f21b0c9d4"

def check_license(key):
    if key == "PRO-2026-XYZ":
        return "unlocked"
    return "locked"

print(check_license("PRO-2026-XYZ"))

Before decompiling anything, I searched the raw .pyc bytes for my "secret" strings. Every one of them is stored verbatim — no decompiler required:

FOUND  sk-live-8f21b0c9d4
FOUND  PRO-2026-XYZ
FOUND  API_KEY
FOUND  check_license
FOUND  unlocked
FOUND  locked

Python ships a disassembler in the standard library (dis). I loaded the code object straight out of the .pyc and disassembled it. You don't need to "decompile" — you can just read the license check:

  1   LOAD_CONST   0 ('sk-live-8f21b0c9d4')
      STORE_NAME   0 (API_KEY)
  3   LOAD_CONST   1 (<code object check_license>)
      MAKE_FUNCTION
      STORE_NAME   1 (check_license)

Disassembly of <code object check_license>:
      LOAD_CONST   1 ('PRO-2026-XYZ')
      COMPARE_OP   2 (==)
      LOAD_CONST   2 ('unlocked')

Read it back to yourself: assign API_KEY, define check_license, and inside it compare the argument to "PRO-2026-XYZ" and return "unlocked". That's the original program, minus the whitespace. Anyone who wants to patch the check just flips that comparison.

To be sure the .pyc was fully self-contained, I renamed it and ran it directly — the .py was already gone:

$ python runme.pyc
unlocked

So the .pyc is a complete, runnable copy of your program that also happens to leak your strings and expose your logic. That's the opposite of protection.

If reading bytecode isn't your idea of fun, decompilers rebuild real .py source. Which one you use depends entirely on the Python version the .pyc was built for:

I'll be honest about my own run: my .pyc was Python 3.11, and both uncompyle6 and decompyle3 currently top out around 3.8–3.9 — on 3.11 they wouldn't even start (their bytecode tables don't know that version yet). For 3.10 and up you reach for pycdc — which is exactly what powers our free, in-browser .pyc Decompiler (it runs pycdc compiled to WebAssembly, so nothing is uploaded). But notice the point of this whole exercise: I never actually needed a decompiler. The strings and the dis output already gave me everything.

Shipping .pyc instead of .py stops exactly one thing: a colleague double-clicking the file to read it in Notepad. It does not stop anyone who spends five minutes. If your goal is to protect an algorithm, hide a key, or make a license check hard to bypass, .pyc does none of it.

What actually helps, in order of effort:

1. Obfuscate the source first — rename everything and encrypt string literals so even the disassembly is unreadable. Our free Python Obfuscator does this at the AST level.
2. Move secrets off the client — load API keys from the environment or a server, and validate licenses server-side. Anything on the user's machine can be extracted.
3. Compile to a native module (.pyd/.so via Cython, or a Nuitka binary) so there's no bytecode to disassemble in the first place. See Python to EXE and Obfuscator PRO.

And if you *do* want to ship bytecode, at least obfuscate before you marshal it — a decompiled blob of already-mangled names buys you far more than a raw .pyc.