Python `marshal` Explained: Bytecode Loaders and Why They’re Weak Protection

• marshal.dumps(compile(src)) turns source into a code object → bytecode blob.
• A loader runs it with exec(marshal.loads(base64.b64decode(b"..."))) — no .py shipped.
• The blob is version-locked: bytecode magic changes each minor version, so a 3.12 blob won't run on 3.11/3.13.
• It is weak: decompilers (decompyle3, pycdc) rebuild near-original source, and AV flags exec(marshal.loads(...)).
• Build it free with the Marshal Encryptor (choose Python 3.10–3.13) — and obfuscate first for meaningful protection.

marshal is a standard-library module that serializes internal Python objects — most usefully compiled code objects — into bytes. It's what CPython itself uses to write .pyc files. Unlike pickle, it isn't meant for general data and its format isn't guaranteed stable across versions, which matters a lot here.

import marshal, base64

src = 'def greet(name):\n    return f"Hello, {name}!"\nprint(greet("World"))'
code = compile(src, "<pyd>", "exec")
blob = base64.b64encode(marshal.dumps(code)).decode()

loader = f'import marshal, base64\nexec(marshal.loads(base64.b64decode("{blob}")))'
exec(loader)   # ->  Hello, World!

The loader is the whole "encrypted" artifact: a couple of imports and one exec. It runs your original program — but there's no readable source in it.

CPython stamps every bytecode format with a magic number that changes each minor version, and the opcodes themselves change too. A code object marshaled by one version won't reliably load — or will crash on execution — under another. That's why you can't build a "3.12 blob" on a 3.11 interpreter.

1. Open the Marshal Encryptor.
2. Paste your Python source.
3. Pick your target Python version (3.10, 3.11, 3.12, or 3.13) — it must match where you'll run the output.
4. Click Marshal Encrypt and copy the loader.
5. Run it only on that Python version. For real protection, run your code through the Python Obfuscator first, then marshal.

Marshaling changes the *representation* of your code, not its recoverability. Three hard limits:

• It decompiles. Tools like decompyle3 and pycdc reconstruct readable .py from marshaled bytecode — names and logic mostly intact.
• Strings are in the clear. Your literals (API keys, URLs) sit inside the bytecode as plain text.
• Antivirus hates it. exec(marshal.loads(base64.b64decode(...))) is a classic malware pattern, so legitimate apps can get quarantined.

For shipping code, marshal and .pyc are two views of the same thing (bytecode); neither protects source. pickle is for data, not code, and is unsafe on untrusted input.

• Shipping a blob for the wrong Python version — it'll fail to load or crash. Match the target exactly.
• Assuming it's secure — it decompiles; obfuscate first.
• Leaving secrets in the code — they survive in the bytecode verbatim.
• Ignoring antivirus — test your build against AV before distributing.

marshal is a neat way to ship Python as bytecode, and it's genuinely useful for packaging — but it's a light deterrent, not a lock. Pick the right target version, don't rely on it alone, and pair it with real AST obfuscation. Build a loader in seconds with the free Marshal Encryptor.