Audit a WASM module’s imports and exports.
safe · secure · no server · works offline · fast
…or just start typing at the cursor.
safe · secure · no server · works offline · fast
…or just start typing at the cursor.
Drop a .wasm and OmniViewer reads its interface: every
import the module needs from the host — the module and
field name, the kind (function, memory, table or global) and the signature
— and every export it exposes to your code. It is the
fastest way to audit an untrusted or undocumented module before you wire it
into a page.
Imports tell you what the module expects the host to provide (a
console.log shim, a shared memory, a WASI call); exports tell you
the functions and globals you can actually call. The same drop also gives you
the full WAT decompile and the section byte map.
It’s one lens on OmniViewer’s WASM Viewer & Decompiler — Read .wasm: drop a file and every tab is one click away. OmniViewer opens every file format, entirely in your browser — no upload, no server.
No. OmniViewer is a static page with no server-side processing: your .wasm is read directly by your browser, and every tab — WAT, interface, sections and stats — runs locally in a Web Worker. The module never leaves your computer.
WAT is the WebAssembly text format — the human-readable S-expression form of a module. OmniViewer disassembles the binary bytecode of each function into its instructions (local.get, i32.add, call, block/loop/if and the rest) and prints the module as WAT, the same shape wasm2wat produces, entirely in your browser.
A .wasm is a flat list of sections, each prefixed with its byte length, so OmniViewer walks the section table by reading only the headers — a few kilobytes of reads at any size. The large data payload is never loaded into memory, and the WAT decompile reads only the bounded prefix that holds the code.
Yes — that is the Interface tab. It lists every import (the module and field name, the kind, and the signature) the module needs from its host, and every export it exposes to your code. It is the fastest way to audit an untrusted or undocumented .wasm.
The full MVP instruction set plus the common extensions: sign-extension, saturating float-to-int truncation and bulk-memory operations (the 0xFC prefix), reference types, and SIMD/v128 opcodes (the 0xFD prefix). An unrecognized opcode stops that one function’s disassembly cleanly and the tool re-syncs at the next function, so the output is always complete and readable.
No. OmniViewer parses and disassembles the module in pure JavaScript, so it works in any modern browser on Windows, Linux, macOS or a phone. No wabt, no emscripten, no Rust or Node install.
Yes. The format is the same whatever the source language, so a module compiled from Rust, C/C++ (Emscripten or WASI), Go, TinyGo, AssemblyScript or Zig all open the same way. When the module carries a custom “name” section, the WAT and interface show the original function names.