Debug .wasm and .wat in your browser. Step instructions, set breakpoints and memory watchpoints, and step backward through the trace.
Open a .wasm binary or edit WebAssembly Text and inspect the module without installing a toolchain. The debugger decodes binary sections, function signatures, imports, exports, globals, tables, data segments, instruction offsets, control-flow structure and custom names. WAT is compiled with the WebAssembly Binary Toolkit and can be downloaded again as text or binary.
Choose an exported function, provide typed arguments, and step into, over, or out of calls. Every instruction records the operand stack, locals, globals, call frames, table state, host-import calls, memory reads, and byte-level memory writes.
Because writes are recorded as reversible deltas, Step Back restores the previous state rather than replaying from the beginning. Drag the trace cursor to jump anywhere you have already been. Continuing from an earlier point discards the old future and starts a new timeline, which is how you test a different argument without losing the context you built up getting there.
Breakpoints pause before a selected instruction. Read, write and read/write watchpoints pause when an address range is touched, and the memory viewer highlights the bytes the current instruction read or wrote. "Last read" and "last write" jump to the most recent access of an address before the cursor, which is the fastest way to answer "what put this value here".
State comparison shows what changed between any two points in the trace. On a loop that is misbehaving, comparing iteration three to iteration four is usually more informative than watching either one.
Uploaded code is decoded and interpreted by a purpose-built interpreter. It is not handed to the browser's WebAssembly engine and instantiated. No filesystem or network capability is ever supplied.
Common WASI calls are modelled with deterministic, capability-free stubs: fd_write, proc_exit, random_get and clock_time_get. Standard output is captured in the UI. This is not a full WASI runtime, and a module that needs real files, sockets or processes receives safe zero-value stubs rather than working I/O.
Custom sections often say more about provenance than the code does. The debugger summarises producers, target_features, linking, reloc.*, dylink.0, build ID and sourceMappingURL, and attributes size per section and per function. The size view answers "why is this bundle 4 MB" faster than any bundler report, because it points at the specific functions responsible.
Component Model envelopes are detected and reported with an explicit unsupported boundary. WIT interface inspection and component execution are scoped as later work rather than partially claimed here.
The security panel highlights powerful host imports, indirect calls, unbounded or unusually large memories, memory growth, shared memory, and explicit trap paths.
These are review leads, not a verdict. A clean report does not certify a module as safe, and a flagged import is often entirely legitimate. Use the panel to decide where to point the debugger, not to decide whether to trust a dependency.
Execution is capped at 50,000 instructions and 32 MiB of linear memory. The interpreter covers core numeric, control-flow, variable, table, memory, call, conversion, sign-extension, saturating-conversion and many bulk-memory instructions, plus commonly used reference-types operations. Modules using SIMD, threads, exception handling, GC or memory64 can still be inspected where decoding succeeds, but execution stops with a clear diagnostic at an unsupported instruction rather than guessing.
Diagnose a divide-by-zero, unreachable, invalid indirect-call or out-of-bounds trap by stepping to it and reading the state that produced it. Review a third-party module's imports and exported surface before integration. Trace compiler-generated control flow and inspect function-level dynamic coverage. Learn stack-machine execution with the editable factorial, memory, nested-call, WASI output and trap examples. Export a portable JSON trace for a bug report.
Yes. Open a .wasm binary to decode it and generate an editable WAT representation, or open and build a .wat file directly. You can also start with one of the included factorial, memory, nested-call, WASI output, or trap examples.
No. Files stay in your browser. The tool validates and decodes the module, then models its instructions in a custom interpreter instead of instantiating the uploaded module as native WebAssembly. It grants no filesystem or network capabilities.
Every executed instruction stores compact state metadata plus reversible memory deltas. Step Back or move the timeline cursor to restore the frames, locals, globals, stack, tables, output, deterministic random state, and changed memory bytes at that point. If you continue from the past, the future branch is replaced with a new trace.
A watchpoint is an address range that pauses execution after an instruction reads it, writes it, or either. The memory panel highlights reads and writes for the selected trace entry, and Last read or Last write jumps to the most recent access before the current cursor.
It supports deterministic, capability-free stubs for common small-module calls such as fd_write, proc_exit, random_get, and clock_time_get. Standard output is captured in the UI. It is not a full WASI runtime, and modules needing files, sockets, processes, or unsupported host APIs will receive safe zero-value stubs.
The interpreter covers core numeric, control-flow, variable, table, memory, call, conversion, sign-extension, saturating-conversion, and many bulk-memory instructions. Newer proposal families such as SIMD, threads, exceptions, GC, and memory64 are detected, but individual unsupported instructions may stop decoding or execution with a clear warning.
No. The report is a static review aid. It flags capabilities and patterns worth investigating, including host I/O imports, indirect calls, unbounded memory, memory growth, shared memory, and explicit trap paths. A clean report is not a guarantee that a module is safe.
Free online disassembler: convert hex machine code to assembly. Multi-architecture (x86, x86-64, ARM, ARM64, RISC-V, MIPS, PowerPC, SPARC, 68K), Intel/AT&T syntax, 100% client-side.
Free online hex editor and binary file viewer. Upload a file to view and edit raw bytes in hex/ASCII, inspect int/float/string values with endianness, search hex or text, and export. 100% client-side.
Extract ASCII and Unicode strings from binary files for malware analysis. Detect URLs, IPs, file paths, registry keys, and email addresses.
Free Shannon entropy calculator for malware analysis. Detect packed, encrypted, or obfuscated binaries with entropy visualization, byte distribution analysis, and section-by-section scanning.
Identify file types by magic numbers and signatures. Detect file extension spoofing and verify true file formats for security analysis.
Keep binary artifacts, hashes, notes, findings, derived files, and analysis-tool handoffs together in a private browser workspace.