Python Marshal Decrypt
Reverse a marshal loader and recover readable Python source — base64-decode, decompress (zlib/zstd), unmarshal, decompile, plus disassembly and a downloadable .pyc. Runs 100% in your browser.
Why use this tool?
Use the Marshal Decrypt tool when you have a marshal loader — the exec(marshal.loads(base64.b64decode("…"))) shape produced by marshal "encryptors" and simple packers — and want the readable Python back. It extracts the base64 payload, decompresses it if the loader used zlib or zstd, unmarshals it into a code object, decompiles that to source, and also shows the full disassembly and a downloadable .pyc. It's the exact inverse of the Marshal Encryptor.
Paste your own loader, or generate one with the Marshal Encryptor to try it. Compression is read from the loader itself (aliases and nested codecs supported) — the dropdown only forces it for a bare payload.
Recovered source is a best-effort reconstruction from bytecode — "syntax-checked" means it compiles under the selected Python, not that it behaves identically to the original. Comments, spacing and quote style are lost, and names removed by obfuscation can't be restored. If you ship Python and need a check that survives being unmarshalled, keep the decision on a server with a license system like Licers.
If unmarshaling brings the code back, so does the license check inside it.
A marshal loader is just a code object the interpreter has to run, so it decodes straight back to constants, strings and control flow — a hard-coded key or trial check comes out with it, ready to be read or patched. Encoding only slows someone down. Licers keeps the decision on a server with Ed25519-signed, device-bound responses, so a recovered or patched client still can't forge a valid license.
Tool facts
- Supported Python
- Python 3.10 – 3.14 (match the build)
- Input limit
- Limited only by your device
- Last reviewed
- 2026-09-05
What it can't do
- •Guarantee exact original source — recovery is best-effort; complex code can come back partial or slightly wrong.
- •Restore comments, blank lines, or the original quote style — those aren't stored in bytecode.
- •Un-obfuscate names — identifiers already renamed by an obfuscator stay renamed.
- •Recover Python 3.14 source yet — the decompiler can't read that bytecode; you get disassembly + a .pyc.
About Python Marshal Decrypt
A marshal loader isn't encrypted — it's encoded. marshal.dumps() serializes a compiled code object to bytes; base64 makes those bytes printable; zlib or zstd (optionally) shrink them. The loader reverses that chain at import time and hands the code object to exec(). This tool does the same reversal but never runs your code: base64-decode, decompress, then marshal.loads() to recover the code object — then our decompiler rebuilds readable source, with the exact disassembly and a rebuilt .pyc alongside it.
Recovery is best-effort and depends on the Python version, because a code object's format changes between releases. It recovers source for loaders built with Python 3.10 through 3.14; newer versions and complex code (async functions, for example) get a deeper reconstruction pass that takes a little longer. Leave "Built with" on Auto-detect and the tool finds the version the loader was built for, so opcodes decode correctly and the .pyc carries the right magic number. "Auto-detect" reads the compression (zlib/zstd) from the loader text.
Be clear-eyed about what a decompiler can and can't return: comments, blank lines and quote style are gone (bytecode doesn't store them), names already scrambled by an obfuscator stay scrambled, and producing valid-looking Python doesn't prove it behaves identically to the original — always sanity-check against the disassembly. For a second opinion, download the .pyc and run it through the dedicated .pyc decompiler, or inspect opcodes with the bytecode disassembler. The Marshal Encryptor builds these loaders; how Python marshal works and reversing marshal-obfuscated bytecode go deeper.
Frequently Asked Questions
Explore Other Tools
Python Deobfuscator
A general Python deobfuscator and obfuscation-strength checker. Reverse weak lambda/exec loaders (base64 + zlib/bz2/lzma, nested layers) to reveal the real source — decoding the payload without ever running it — and flag strongly-protected code that can't be trivially peeled. Paste or upload a .py.
Python .pyc Decompiler
Decompile a compiled Python .pyc back to readable source — Python 2.x through 3.14, with the version detected automatically. Most files decompile in about a second.
Python Bytecode Disassembler
Disassemble Python to CPython bytecode with the dis module — explore opcodes, code objects, jumps and constants. Runs in your browser.
Python Type Checker
Type-check your Python online with mypy — runs 100% in your browser via WebAssembly. Pick a target Python version (3.8–3.14) and strict mode.