PyInstaller Decompiler Online
Extract PyInstaller and py2exe applications, repair their bytecode, and recover readable Python source.
How It Works
Detect
The file is identified from its PyInstaller cookie or py2exe PE resource, before normal EXE handling.
Extract & Repair
Embedded modules are unpacked and stripped PYC headers are rebuilt from an intact sibling.
Browse
Read recovered source under sources/ or download raw bytecode from pyc/.
What PyInstaller Puts Inside an Executable
PyInstaller combines a native bootloader, a Python interpreter, extension modules, and the application's compiled .pyc files. The payload is a CArchive appended to the launcher. A distinctive cookie near the end of the file points to its table of contents, which is why the same detection works for Windows, Linux, and macOS builds.
The original formatting and comments are not present in bytecode, but function names, constants, imports, control flow, and often local variable names remain. That is normally enough to reconstruct useful Python source.
The PYC Header Problem
PyInstaller strips the normal header from some entry-point modules. Sending those bytes directly to a Python decompiler either fails or, worse, selects the wrong bytecode format. After extraction this service verifies every module and repairs a bare code object with the complete header from an intact sibling in the same archive.
PyInstaller vs py2exe vs Nuitka
- PyInstaller stores modules in an appended CArchive and usually a compressed PYZ archive. It works on Windows, Linux, and macOS.
- py2exe is Windows-only. Its startup scripts live in a PE resource named
PYTHONSCRIPT; larger builds often add a ZIP containing the rest of the modules. - Nuitka compiles through C to native code. There is no equivalent module archive to unwrap, so automatic recovery to Python source is not possible.
What the Result Contains
Every recovered bytecode file is kept under pyc/, even when source decompilation fails. Successful modules appear under sources/ with the extracted package structure preserved. DECOMPILATION-NOTES.txt records the detected Python version, header repairs, encrypted or unsupported archives, and individual files the bytecode decompiler could not handle.
Python bytecode changes between interpreter releases. For a version newer than the installed decompiler supports, the service preserves the raw modules and says which version was found rather than returning misleading source.
Frequently Asked Questions
Can a PyInstaller EXE be decompiled?
Usually. PyInstaller is a packager, not a native Python compiler. If the archive is readable and its Python bytecode version is supported, much of the source can be reconstructed.
What happens when one module fails?
The other modules are still decompiled. The failed PYC is kept under pyc/ and listed in the notes instead of aborting the entire application.
Are encrypted PyInstaller archives supported?
The extractor attempts to recover the embedded key used by supported PyInstaller releases. When no key can be recovered, the result explains that the archive is encrypted and preserves anything that could be extracted.
Can I upload a Linux binary with no extension?
Yes. PyInstaller detection reads the cookie near the end of the file and does not depend on a .exe suffix.
Where can I decompile a single PYC file?
Use the Python bytecode decompiler when you already have a .pyc or .pyo file and do not need to unwrap an executable.