Python Marshal Decrypt

A marshal loader isn't encrypted — it's encoded. marshal.dumps() serializes a compiled code object to bytes; base64 makes those bytes printable; zlib or zstd (optionally) shrink them. The loader reverses that chain at import time and hands the code object to exec(). This tool does the same reversal but never runs your code: base64-decode, decompress, then marshal.loads() to recover the code object — then a decompiler (pycdc / Decompyle++, compiled to WebAssembly) rebuilds readable source, with the exact disassembly and a rebuilt .pyc alongside it.

Recovery is best-effort and depends on the Python version, because a code object's format changes between releases. In practice pycdc rebuilds clean source through Python 3.12, partial source on 3.13 (the newest opcodes can't always be reconstructed), and can't yet read 3.14 bytecode at all — for 3.14 you get the complete disassembly and a .pyc to try elsewhere. Pick the version the loader was built for and the tool loads the matching CPython (via Pyodide) so opcodes decode correctly and the .pyc carries the right magic number. "Auto-detect" reads the compression (zlib/zstd) from the loader text.

Be clear-eyed about what a decompiler can and can't return: comments, blank lines and quote style are gone (bytecode doesn't store them), names already scrambled by an obfuscator stay scrambled, and producing valid-looking Python doesn't prove it behaves identically to the original — always sanity-check against the disassembly. For a second opinion, download the .pyc and run it through the dedicated .pyc decompiler, or inspect opcodes with the bytecode disassembler. The Marshal Encryptor builds these loaders; how Python marshal works and reversing marshal-obfuscated bytecode go deeper.