Free Online Disassembler
Online Disassembler turns machine code into assembly in your browser with Capstone 5. Paste hex, \x escapes, C or Python byte arrays or base64, or pick a range of a binary file, then choose x86 (Intel, AT&T or MASM syntax), ARM, Thumb, ARM64, MIPS, PowerPC, RISC-V, WebAssembly, BPF or ten more architectures. Invalid bytes become .byte lines and decoding continues.
- Architectures:
- 18, incl. x86, ARM64, MIPS, RISC-V, WebAssembly
- Input:
- Hex, \x escapes, C/Python arrays, base64, file
- Limit:
- 256 KiB per run; share links up to 4 KiB
- Price:
- Free
- Runs:
- Locally, in your browser
- Uploads:
- None: files never leave your device
- Account:
- Not needed
Quick answers
Are my bytes uploaded anywhere?
No. Capstone runs as WebAssembly in a background worker on your device. The only download is the engine itself, about 3.6 MB from this site, the first time you press Disassemble or open a share link. Files are read locally, and only the range you choose. A share link keeps the bytes after the # of the address, a part that browsers do not send to servers.
Which architectures are supported?
All 18 of Capstone 5: x86 (16, 32 and 64-bit), ARM and Thumb (Cortex-M included), ARM64, MIPS (32, 64, Release 6, microMIPS), PowerPC (32, 64, paired singles), SPARC, RISC-V (32 and 64-bit, with or without compressed instructions), WebAssembly, eBPF and classic BPF, Ethereum EVM, 68000 to 68060, the 6800/6809 family, 6502 and 65816, SuperH, SystemZ, TriCore, TMS320C64x and XCore.
Processed on your device: your files are never uploaded. How it works
Network activity in this tab
What this page has requested since you opened the site in this tab. An upload is any request that sends data: POST, PUT, PATCH or a request with a body.
No uploads: nothing has been sent from this page.
No network requests yet.
To see every request, open your browser's developer tools (Network tab).
How to use the Online Disassembler
- Paste the bytes as hex (55 48 89 e5, 0x55, 0x48, \x55\x48, or a C or Python array) or as base64, or open a binary file and set the Offset and Length to read.
- Choose the Architecture, the Mode, the Byte order and, for x86, Intel, AT&T or MASM syntax. Set the Start address so that jump and call targets show real addresses.
- Press Disassemble: the listing shows address, bytes, mnemonic and operands, and updates as you edit. Turn on Instruction details to see the registers read and written and the instruction groups.
- Use Copy listing or Download .txt, or Copy share link to send the bytes and settings in a link.
Credits & open source
Our own code plus open-source libraries. Thank you to the people who make these projects.
- Capstone.js (Capstone 5)The Capstone multi-architecture disassembly framework compiled to WebAssembly (self-hosted from /vendor/capstone). © Alexandro Sanchez Bach (Capstone.js bindings); Capstone by Nguyen Anh Quynh and the Capstone contributors · BSD-3-Clause
Web platform APIs used: WebAssembly, Web Workers, File API, Clipboard API, URL API.
Full license texts: third-party notices · all credits
Frequently asked questions
What do the .byte lines mean?
They hold bytes that are not a valid instruction for the chosen architecture and mode. The disassembler skips them one alignment step at a time (1 byte on x86, 4 on ARM64) and carries on. Many .byte lines usually mean a wrong architecture, mode or byte order, or that the bytes are data rather than code.
How do I paste shellcode from msfvenom or pwntools?
Paste the output as it is: C strings ("\x48\x31…"), Python lines (buf += b"\x48…"), pwntools byte strings with printable characters (b'jhH\xb8/bin'), or 0x arrays. The code around the bytes is ignored, and anything that is not a byte is reported with its line and column.
Can it disassemble a whole EXE or ELF file?
It decodes raw bytes from the offset you choose, up to 256 KiB; it does not read headers, sections or symbols. Look up the file offset of the code section first (readelf, objdump or a PE viewer show it), then disassemble that range with the matching architecture and start address.
Does it follow jumps or decompile the code?
No. It is a linear sweep: bytes are decoded in order from the start, so data mixed with code turns into odd instructions. There is no control-flow analysis, no decompiler and no assembler.