RPG Maker Decompiler Online

Two Engines, Two Different Jobs

"RPG Maker" covers two generations that have almost nothing in common once you open the files, so this page does two quite different things depending on what you upload.

XP, VX and VX Ace are Ruby, and recovering them is the real prize. The engine keeps everything you typed into its script editor inside Data/Scripts.rxdata, Scripts.rvdata or Scripts.rvdata2, serialised with Ruby's Marshal and compressed with zlib. Nothing was ever compiled, so what comes back is the original file — comments, blank lines, indentation and all. This is source recovery, not decompilation, and the difference is visible the moment you open the result.

MV and MZ are JavaScript, and there is nothing to decompile at all: the engine and every plugin ship as readable .js. What those versions do instead is obfuscate the media, and that is what gets undone here.

What to Upload

• Game.rgssad, Game.rgss2a, Game.rgss3a — the whole game in one file. Everything inside is extracted and the Ruby is recovered into a Scripts/ folder.
• A Scripts.rvdata2 on its own — if you already unpacked the archive with another tool, this is all you need.
• A single .rpgmvp, .rpgmvo, .png_, .ogg_ or .m4a_ — decrypted back to real media.
• A zipped MV or MZ project — the game's JavaScript and data, plus every encrypted asset decrypted with the project's own key.
• An RPG Maker Android .apk — the usual Java, resources and smali output, with the game itself added beside it.

The Encryption Key, and Why You Usually Do Not Need It

MV and MZ "encryption" prepends a 16-byte header and XORs only the first 16 bytes of the real file against a key. Everything past that is the untouched original. The key sits in cleartext in the game's own www/data/System.json under encryptionKey, so uploading a project or an APK finds it automatically.

A single asset with no project around it looks like a dead end, and for images it is not. Every PNG begins with the same 16 bytes — the 8-byte signature, then the length and type of the IHDR chunk — and those are precisely the bytes the key was applied to. The key is therefore not guessed, it is read back out of the file. One image from a game is enough to decrypt that game's audio too.

Audio has no fixed prefix of its own, so a lone .rpgmvo with an unknown key falls back to the empty-password default and, failing that, says so rather than writing a corrupt file. A decrypted file is only kept when it really carries the signature its name promises.

What You Get Back

From an XP, VX or VX Ace archive:

• Scripts/ — one .rb per entry, numbered in the order the engine loads them, because that order is what makes the game run.
• Data/, Graphics/, Audio/ — the archive's own tree, exactly as it was packed.

From an MV or MZ project or APK:

• js/ — the engine and the game's plugins, already readable.
• data/ — maps, actors, events and the rest of the database as JSON.
• decrypted/ — the obfuscated media, restored to ordinary .png, .ogg and .m4a under its original paths.

Limits

• Only Scripts.* is deserialised. The other .rxdata and .rvdata files are maps and database records built from the engine's own Ruby classes. They are extracted as they were packed but never rebuilt into objects, because doing that means letting an uploaded file name a class to instantiate.
• Scripts an author deleted are gone. Only what is in the script list can come back.
• Encrypted media that is not really media is dropped. If a key produces bytes that are not a PNG or an Ogg stream, no file is written — a corrupt .png that opens to nothing is worse than an honest note.
• Anything downloaded after installation was never in the upload.

Frequently Asked Questions