Does Decompiler Explorer Retain Uploaded Binaries?

Updated

Yes. Decompiler Explorer (dogbolt.org) states on its upload page that uploaded binaries are retained. The page also sets a 2MB size limit per file. If you are thinking about uploading a proprietary or sensitive binary, treat it as data that stays on the service rather than something that is deleted after analysis.

What the site says about uploads

The relevant statements come directly from the upload interface:

  • Retention: "Uploaded binaries are retained." This is a plain notice, not a promise of automatic deletion.
  • Size limit: "Your file must be less than 2MB in size." Files at or above that limit are not accepted.
  • Open source: The project describes itself as open source and points to GitHub for the code. You can inspect the source to understand how the service is built, but the retention notice is about the running service, not just the code.

What this means for safety

The tool is designed for inspecting and comparing decompiler output, not for confidential analysis. A few practical implications:

  • Do not upload anything you would not want stored on a third-party server. That includes proprietary firmware, internal tools, licensed software, or binaries containing credentials, keys, or customer data.
  • Assume the file can persist. Because the page says binaries are retained, plan as if the upload is durable. There is no stated deletion control on the page.
  • The 2MB limit is a hard constraint. If your target is larger, you cannot use the hosted upload as-is.

When it is reasonable to use

Decompiler Explorer is a good fit when the binary is already public or non-sensitive:

  • CTF challenge binaries and other publicly distributed samples.
  • Open-source or otherwise freely redistributable programs.
  • Small test binaries you created yourself for comparing decompilers.
  • The built-in samples the site provides, such as the x86 Linux CTF challenge, Arm Linux Hello World, and the arm64/x86 "Megatest" binaries.

For anything private, the safer path is to run decompilers locally or in your own controlled environment instead of uploading to a shared service.

Practical checklist before uploading

  1. Confirm the file is under 2MB.
  2. Confirm you are allowed to share the binary with a third party.
  3. Confirm it contains no secrets, credentials, or personal data.
  4. If any answer is uncertain, do not upload — use a local decompiler setup instead.

The short version: the site is transparent that uploads are retained, so its safety depends entirely on what you choose to upload. Public samples are fine; sensitive binaries are not.