Debug WebAssembly online. Open .wasm or .wat, inspect sections and imports, step through instructions, watch memory, diagnose traps, and travel backward. Nothing is uploaded.
Open a .wasm binary or edit WebAssembly Text (WAT) and inspect the module entirely in your browser. The debugger decodes binary sections, function signatures, imports, exports, globals, tables, data segments, instruction offsets, control-flow structure, and custom names. WAT is compiled with the WebAssembly Binary Toolkit and can be downloaded again as either text or binary.
Choose an exported function, provide typed arguments, and step into, over, or out of calls. Each instruction records the operand stack, locals, globals, call frames, table state, host-import calls, memory reads, and byte-level memory writes. Drag the trace cursor or choose Step Back to restore an earlier state without restarting the module. Continuing from an earlier point creates a new execution timeline.
Breakpoints pause before a selected instruction. Read, write, and read/write watchpoints pause when an address range is touched. The memory viewer highlights bytes read or written by the current instruction and can jump to the last access of an address. State comparison shows what changed between any two points in the trace.
Uploaded code is decoded and interpreted by a purpose-built debugger; it is not instantiated as native WebAssembly. Filesystem and network capabilities are never supplied. Common WASI output, deterministic clock, and deterministic random calls are modeled so small command-line modules can still be explored. Execution is capped at 50,000 instructions and 32 MiB of linear memory.
The security view highlights powerful host imports, indirect calls, unbounded or unusually large memories, memory growth, shared memory, and explicit trap paths. These are review leads, not proof that a module is safe or malicious.
The debugger focuses on WebAssembly core instructions plus commonly used reference-types, bulk-memory, saturating-conversion, and sign-extension operations. Modules using SIMD, threads, exception handling, GC, memory64, or other newer proposals can still be inspected where decoding is possible, but execution may stop at an unsupported instruction.
Yes. Open a .wasm binary to decode it and generate an editable WAT representation, or open and build a .wat file directly. You can also start with one of the included factorial, memory, nested-call, WASI output, or trap examples.
No. Files stay in your browser. The tool validates and decodes the module, then models its instructions in a custom interpreter instead of instantiating the uploaded module as native WebAssembly. It grants no filesystem or network capabilities.
Every executed instruction stores compact state metadata plus reversible memory deltas. Step Back or move the timeline cursor to restore the frames, locals, globals, stack, tables, output, deterministic random state, and changed memory bytes at that point. If you continue from the past, the future branch is replaced with a new trace.
A watchpoint is an address range that pauses execution after an instruction reads it, writes it, or either. The memory panel highlights reads and writes for the selected trace entry, and Last read or Last write jumps to the most recent access before the current cursor.
It supports deterministic, capability-free stubs for common small-module calls such as fd_write, proc_exit, random_get, and clock_time_get. Standard output is captured in the UI. It is not a full WASI runtime, and modules needing files, sockets, processes, or unsupported host APIs will receive safe zero-value stubs.
The interpreter covers core numeric, control-flow, variable, table, memory, call, conversion, sign-extension, saturating-conversion, and many bulk-memory instructions. Newer proposal families such as SIMD, threads, exceptions, GC, and memory64 are detected, but individual unsupported instructions may stop decoding or execution with a clear warning.
No. The report is a static review aid. It flags capabilities and patterns worth investigating, including host I/O imports, indirect calls, unbounded memory, memory growth, shared memory, and explicit trap paths. A clean report is not a guarantee that a module is safe.
Free online disassembler: convert hex machine code to assembly. Multi-architecture (x86, x86-64, ARM, ARM64, RISC-V, MIPS, PowerPC, SPARC, 68K), Intel/AT&T syntax, 100% client-side.
Free online hex editor and binary file viewer. Upload a file to view and edit raw bytes in hex/ASCII, inspect int/float/string values with endianness, search hex or text, and export. 100% client-side.
Extract ASCII and Unicode strings from binary files for malware analysis. Detect URLs, IPs, file paths, registry keys, and email addresses.
Free Shannon entropy calculator for malware analysis. Detect packed, encrypted, or obfuscated binaries with entropy visualization, byte distribution analysis, and section-by-section scanning.
Identify file types by magic numbers and signatures. Detect file extension spoofing and verify true file formats for security analysis.
Keep binary artifacts, hashes, notes, findings, derived files, and analysis-tool handoffs together in a private browser workspace.