{
  "schemaVersion": "1.0",
  "canonicalPage": "https://fileformat.co/ext/wasm",
  "inspectorUrl": "https://fileformat.co/inspect",
  "spec": {
    "slug": "wasm",
    "extension": ".wasm",
    "aliases": [],
    "name": "WebAssembly Binary Module",
    "shortName": "WASM",
    "category": "devtools-security",
    "tier": 1,
    "summary": "Portable, sandboxed stack-machine binary bytecode format (`\\0asm` v1) structured as a sequence of LEB128-framed Type, Import, Function, Memory, Export, and Code sections.",
    "technicalNotes": "Leading null byte `0x00` prevents accidental interpretation as UTF-8 text; section lengths use unsigned LEB128 variable-length integers so parsers skip massive Code sections in O(1).",
    "mimeTypes": [
      "application/wasm"
    ],
    "identifiers": {
      "specUrl": "https://webassembly.github.io/spec/core/binary/modules.html"
    },
    "binarySignature": {
      "endianness": "little",
      "magicBytes": [
        {
          "offset": 0,
          "hex": "00 61 73 6D 01 00 00 00",
          "ascii": ".asm....",
          "description": "'\\0asm' magic + uint32_le binary version 1"
        }
      ],
      "containerFamily": null,
      "headerLayout": [
        {
          "offset": "0x00 - 0x03",
          "byteOffset": 0,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint8[4]",
          "fieldName": "magic",
          "description": "0x00 0x61 0x73 0x6D ('\\0asm')"
        },
        {
          "offset": "0x04 - 0x07",
          "byteOffset": 4,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint32_le",
          "fieldName": "version",
          "description": "Binary format version (1)"
        },
        {
          "offset": "0x08+",
          "byteOffset": 8,
          "byteLength": 8,
          "lengthLabel": "var",
          "dataType": "u8+leb128",
          "fieldName": "sections",
          "description": "Section ID (0..12) + LEB128 byte length + payload"
        }
      ]
    },
    "securityProfile": {
      "riskLevel": "medium",
      "allowsArbitraryCodeOrMacros": true,
      "xxeRisk": false,
      "polyglotPrependRisk": false,
      "pickleDeserializationRisk": false,
      "uploadValidationNotes": "Audit the Import section (id=2) before instantiating untrusted .wasm plugins to verify they only bind approved WASI/host capabilities, and enforce fuel/epoch CPU limits."
    },
    "codeSnippets": {
      "python": "import struct, sys\nwith open(sys.argv[1], \"rb\") as f:\n    magic, ver = struct.unpack(\"<4sI\", f.read(8))\n    assert magic == b\"\\x00asm\" and ver == 1\n    print(f\"Valid WebAssembly binary v{ver}\")",
      "typescript": "export async function verifyWasmHeader(file: File) {\n  const dv = new DataView(await file.slice(0, 8).arrayBuffer());\n  return dv.getUint32(0, true) === 0x6d736100 && dv.getUint32(4, true) === 1;\n}",
      "rust": "use std::{fs::File, io::Read};\nfn main() -> std::io::Result<()> {\n    let mut b = [0u8; 8];\n    File::open(std::env::args().nth(1).expect(\"usage: <prog> <file>\"))?.read_exact(&mut b)?;\n    assert_eq!(&b[0..4], b\"\\0asm\");\n    println!(\"WASM v{}\", u32::from_le_bytes(b[4..8].try_into().expect(\"fixed-size byte window\")));\n    Ok(())\n}",
      "go": "package main\nimport (\"encoding/binary\"; \"fmt\"; \"io\"; \"os\")\nfunc main() {\n    f, err := os.Open(os.Args[1])\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"open:\", err)\n        os.Exit(1)\n    }\n    defer f.Close()\n    b := make([]byte, 8)\n    if _, err := io.ReadFull(f, b); err != nil {\n        fmt.Fprintln(os.Stderr, \"read:\", err)\n        os.Exit(1)\n    }\n    fmt.Printf(\"WASM v%d\\n\", binary.LittleEndian.Uint32(b[4:8]))\n}"
    },
    "relatedFormats": [
      "ipa",
      "aab",
      "onnx"
    ],
    "verifiedAt": "2026-11-14T16:09:03Z"
  },
  "samples": [
    {
      "id": "wasm-minimal",
      "filename": "minimal-add.wasm",
      "variant": "minimal",
      "title": "Minimal Instantiable WebAssembly Module (`add` Export)",
      "description": "41-byte valid WASM v1 binary exporting `add(i32, i32) -> i32`, directly instantiable via `WebAssembly.instantiate()`.",
      "localPath": "/fixtures/v1/wasm/minimal-add.wasm",
      "cdnUrl": "https://fileformat.co/fixtures/v1/wasm/minimal-add.wasm",
      "sizeBytes": 41,
      "sha256": "f61fd62f57c41269c3c23f360eeaf1090b1db9c38651106674d48bc65dba88ba",
      "expectValid": true
    },
    {
      "id": "wasm-realistic",
      "filename": "env-import-memory.wasm",
      "variant": "realistic",
      "title": "WASM Module with Host Import (`env.log`) & Linear Memory",
      "description": "Contains Type, Import, Function, Memory, Export, and Code sections for symbol scanner tests.",
      "localPath": "/fixtures/v1/wasm/env-import-memory.wasm",
      "cdnUrl": "https://fileformat.co/fixtures/v1/wasm/env-import-memory.wasm",
      "sizeBytes": 80,
      "sha256": "f6462abef751b355d056c266a6e5d376afb018bd445477af9d9df333fa0f4f47",
      "expectValid": true
    },
    {
      "id": "wasm-edge-case",
      "filename": "truncated-code-section.wasm",
      "variant": "edge-case",
      "title": "Truncated WASM Code Section",
      "description": "WASM binary whose Code section LEB128 byte length exceeds remaining file bytes.",
      "localPath": "/fixtures/v1/wasm/truncated-code-section.wasm",
      "cdnUrl": "https://fileformat.co/fixtures/v1/wasm/truncated-code-section.wasm",
      "sizeBytes": 75,
      "sha256": "a43778279d60ece37b28759e01fc505e73e18e6274db914e148bd8bfdd8b295d",
      "expectValid": false,
      "edgeCaseTag": "Truncated Code Section"
    }
  ]
}