How to Deobfuscate Python Code (4 Real Methods)

Set expectations first, because this is where people get confused. Deobfuscation reliably gets you back to working, readable code — correct structure, correct logic, the actual strings and constants. What it does not get you back is the *original author's intent*: meaningful names, comments, and formatting that were thrown away during obfuscation are not encoded anywhere, so nothing can reconstruct them.

The most common "obfuscated" Python you'll meet is a packer: the real source is compressed, base64-encoded, and handed to exec(). It looks impenetrable but it's the easiest to reverse. Here's a real one our engine-style packer produced:

import base64, zlib
exec(zlib.decompress(base64.b64decode(
    'eJxdjDsKgDAUBPuc...'   # long base64 blob
)))

The trick is to never call `exec`. Copy the payload and reverse the exact same steps — base64-decode, then decompress — but print the result instead of executing it:

import base64, zlib

payload = 'eJxdjDsKgDAUBPuc...'   # the blob from the file
source = zlib.decompress(base64.b64decode(payload)).decode()
print(source)

def login(user, pw):
    SECRET = "s3cr3t-token"
    return user == "admin" and pw == SECRET

print(login("admin", "s3cr3t-token"))

I verified recovered == original returned True. Because the packer is just reversible encoding, you get the source back exactly — names, strings, and all. If the layers are nested (base64 inside base64, or multiple execs), you repeat the same peel one layer at a time until plain source falls out.

A lot of obfuscation renames identifiers to noise (_0xa, l1ll1) and crushes everything onto few lines. The logic is intact — it's just unreadable. Python's own ast module fixes the layout for free: parse it, then unparse it back to canonical, correctly-indented source.

def _0xa(_0xb, _0xc):
 _0xd = _0xb + _0xc
 return _0xd * 2
print(_0xa(3, 4))

import ast
src = open('mangled.py').read()
print(ast.unparse(ast.parse(src)))

def _0xa(_0xb, _0xc):
    _0xd = _0xb + _0xc
    return _0xd * 2
print(_0xa(3, 4))

Want to see the tree an obfuscator works on? Paste code into the AST viewer — it's the same ast.parse step, visualized.

Some obfuscation ships compiled bytecode instead of source — a marshal.dumps blob, or a shipped .pyc. There's no source to unpack, but the code object still describes every operation. marshal.loads it and dis.dis it:

import marshal, dis
code = marshal.loads(open('blob.bin', 'rb').read())
dis.dis(code)
print('constants:', code.co_consts)

  1   LOAD_SMALL_INT    41
      STORE_NAME         0 (x)
  2   LOAD_NAME          0 (x)
      LOAD_SMALL_INT     1
      BINARY_OP          0 (+)
      ...
constants: (41, None)

Even without pretty source, the disassembly plus co_consts, co_names, and co_varnames tell you the constants, the names touched, and the exact control flow. To go one step further and turn bytecode back into readable Python, use a decompiler — our free online .pyc decompiler handles every CPython version in the browser. (Full walkthrough: decompile a .pyc file.)

Obfuscators love to hide secrets by encoding string literals — base64.b64decode("..."), bytes.fromhex(...), XOR loops. You don't need to run the whole program to reveal them; you evaluate only the decode expression, in isolation, using the AST:

import ast, base64
tree = ast.parse(open('mod.py').read())
assign = [n for n in tree.body if isinstance(n, ast.Assign)][0]
expr = ast.Expression(assign.value)
print(eval(compile(expr, '<x>', 'eval'), {'base64': base64}))

prod-api-key-1234

Every row reverses with the standard library in minutes. That's not a knock on obfuscation — it genuinely raises the effort bar, deters casual copying, and protects trivial IP. But it is not a security boundary, and treating it like one is how secrets leak. If you need to actually *control who can run your code* — not just make it annoying to read — you need something obfuscation can't provide: a check the user can't simply reverse.