Does it run the obfuscated code?

It runs the loader's decode logic (that's how it gets the real bytes), but it replaces exec() and compile() with a capture function inside a sandbox, so the decoded payload is recorded and shown — never executed. And it only runs blocks that call exec(); the moment a layer decodes to a plain program, it stops and displays it instead of running it.

It found several layers — what does that mean?

Some obfuscators stack the loader inside itself several times to look scarier. The tool peels each layer automatically: it decodes one, sees the result is another loader, decodes that, and so on until it reaches real source. The "layers peeled" badge shows how deep it went.

It says it's not a supported loader — now what?

This tool targets exec()-based lambda loaders. If your sample uses marshal (`exec(marshal.loads(…))`) send it to the Marshal Decrypt tool; if it's a compiled `.pyc`, use the .pyc decompiler; if it's keyed/encrypted or fetches its payload from a server, it can't be decoded offline. If it IS an exec loader and still fails, the decode chain may use a codec we don't run — tell us the pattern.

Security Module

Python Deobfuscator

A general Python deobfuscator and obfuscation-strength checker. Reverse weak lambda/exec loaders (base64 + zlib/bz2/lzma, nested layers) to reveal the real source — decoding the payload without ever running it — and flag strongly-protected code that can't be trivially peeled. Paste or upload a .py.

Why use this tool?

This is a general-purpose Python deobfuscator — and a quick way to gauge how strong an obfuscation actually is. A huge share of "free Python obfuscators" produce the same throwaway loader: a lambda that base64-decodes, decompresses (zlib/bz2/lzma) and reverses a blob, then hands it to exec(). It looks scrambled, but it isn't encrypted — there's no key, so it decodes straight back. Paste (or upload) that code here and the tool runs the decode logic in a sandbox with exec() intercepted, so it captures the real payload instead of executing it, then repeats until no wrapper is left — you get the readable Python plus a count of how many layers were stacked. And when code is genuinely protected in depth (keyed encryption, renamed identifiers, flattened control flow) it tells you that too, instead of pretending it can crack it.

Obfuscated input

Result

The recovered source (or a protection-strength report) appears here.

A general Python deobfuscator + obfuscation-strength check. It reverses weak loaders (base64 + zlib/bz2/lzma, reversed or not, single or nested) by decoding the payload — never executing it — in a WebAssembly sandbox, and it flags strongly-protected code that can't be trivially peeled. payload is decoded, not run.

Tool facts

Supported Python: Python 3.x lambda/exec loaders
Input limit: Limited only by your device
Last reviewed: 2026-09-10

What it can't do

•Reverse real cryptographic protection — this handles ENCODED loaders (base64/zlib/bz2/lzma), not keyed encryption.
•Un-rename identifiers — names already scrambled by an obfuscator stay scrambled.
•Recover source from a marshal/.pyc payload — for that, send the result to the Marshal Decrypt or .pyc decompiler tools.
•Decode loaders that only run their payload through eval() (not exec) or that fetch it over the network.

About Python Deobfuscator

The classic loader looks like _ = lambda __ : __import__('zlib').decompress(__import__('base64').b64decode(__[::-1])); exec((_)(b'…')). Each piece is reversible: [::-1] reverses the blob, b64decode turns it back into bytes, zlib.decompress (or bz2/lzma) inflates it, and exec runs the result. This tool executes that exact chain — but with exec and compile swapped for a capture function inside a private namespace — so the loader's own decode logic produces the true source while the payload is recorded, never run. Multi-layer loaders (a loader whose output is another loader) are peeled automatically, up to dozens of levels.

It runs entirely as WebAssembly (Pyodide) in your browser, and it only ever runs blocks that actually call exec() — a wrapper. Once a layer decodes to a plain program with no exec(), the tool stops and shows it rather than running it, so a malicious payload is revealed as text and never executed. If a layer decodes to a marshal loader or a .pyc instead of source, hand the result to the Marshal Decrypt tool or the .pyc decompiler; to inspect obfuscation techniques or build one, see the advanced obfuscator. Deeper reading: how to deobfuscate Python code.

Be realistic about the limits: this reverses ENCODING, not real cryptography. A loader whose key genuinely lives elsewhere, or that pulls its payload over the network, won't decode here. Names an obfuscator already renamed stay renamed, and comments/formatting the original obfuscation dropped can't be brought back — you recover the code that actually runs, which is exactly what you need to understand or audit it.

Frequently Asked Questions

A full lambda/exec loader — the `_ = lambda __ : …decompress(…b64decode(…)); exec((_)(b'…'))` shape that free obfuscators emit. Variations work too: different variable names, no reverse step, or bz2/lzma instead of zlib. Click "Load example" to see the exact shape it recognises.

Explore Other Tools

Python .pyc Decompiler

Decompile a compiled Python .pyc back to readable source with pycdc — in your browser via WebAssembly. Best-effort for 3.0–3.12, partial 3.13, disassembly 3.14.

Python Bytecode Disassembler

Disassemble Python to CPython bytecode with the dis module — explore opcodes, code objects, jumps and constants. Runs in your browser.

Python Type Checker

Type-check your Python online with mypy — runs 100% in your browser via WebAssembly. Pick a target Python version (3.8–3.14) and strict mode.

Code to Flowchart

Turn Python code into a flowchart from the real AST — deterministic, no AI. Handles if, match, loops, try/except and async, with a control-flow-graph mode, unreachable-code highlighting, and Mermaid/SVG/PNG export.