What Is a .WASM File?

WebAssembly Binary (.wasm)

Overview

WebAssembly (WASM) is a binary instruction format for a stack-based virtual machine designed as a portable compilation target for programming languages. It enables deployment on the web for client and server applications with near-native performance.

A .wasm file is compiled code, not source: it is what a Rust, C, C++, Go or AssemblyScript program becomes when built for the WebAssembly target. Browsers, Node.js and standalone runtimes load it and execute it inside a sandbox. This site's own file detector is a .wasm file: Google's Magika model runs in your browser as WebAssembly, which is how identification happens without uploading anything.

Technical Specifications

• Format Type: Binary executable format
• Magic Number: \0asm (00 61 73 6D)
• Version: 4-byte little-endian integer (currently 1)
• File Extension: .wasm; .wat for the textual form
• MIME Type: application/wasm
• Category: Binary
• Specification: W3C WebAssembly Core Specification

Identification

00000000  00 61 73 6d 01 00 00 00  01 07 01 60 02 7f 7f 01  |.asm.......`....|
00000010  7f 03 02 01 00 07 07 01  03 61 64 64 00 00 0a 09  |.........add....|

The first eight bytes are fixed: the magic 00 61 73 6D and version 01 00 00 00. Everything after is a sequence of sections, each a one-byte id followed by a length. The browser's WebAssembly.instantiateStreaming refuses a file whose server does not send Content-Type: application/wasm, so a misconfigured MIME type is the most common reason a .wasm file fails to load.

Format Structure

WebAssembly files consist of:

• Magic number and version
• Section-based structure with type-length-value encoding
• Custom sections for metadata
• Type, import, function, table, memory, global, export, start, element, and code sections

Section layout

Id	Section	Holds
0	custom	Names, source maps, producer info; ignored by the runtime
1	type	Function signatures
2	import	Functions, memories, tables and globals the module needs from the host
3	function	Which type each defined function has
4	table	Indirect-call tables
5	memory	Linear memory declarations
6	global	Global variables
7	export	What the module exposes to the host
8	start	A function to run on instantiation
9	element	Table initialisers
10	code	The function bodies
11	data	Memory initialisers

A .wasm file is also a complete module: it declares exactly what it imports and exports, which is what makes it safe to load and introspect without running it.

History and Development

• 2015: Initial development by Mozilla, Google, Microsoft, and Apple
• 2017: WebAssembly 1.0 specification released, shipping in all four major browsers
• 2019: Became a W3C recommendation
• 2020 to present: WASI (system interface), SIMD, threads, garbage collection and the component model

WebAssembly succeeded asm.js, Mozilla's earlier approach of compiling C to a fast subset of JavaScript. The binary format parses roughly twenty times faster than the equivalent JavaScript and is far smaller over the network.

How to Open a WASM File

A .wasm file is not meant to be opened like a document; it is loaded by a program. Depending on what you want:

To see what is inside

The WebAssembly Binary Toolkit (wabt) converts the binary to its readable text form:

# Binary to text (.wat), the canonical way to read a module
wasm2wat module.wasm -o module.wat

# Summary: sections, imports, exports, function count
wasm-objdump -h module.wasm
wasm-objdump -x module.wasm | head -40

# Without installing anything, in Chrome DevTools: open the Sources panel
# while a page loads the module; DevTools disassembles it to .wat.

wasm-decompile (also in wabt) produces a C-like rendering that is easier to skim than the stack-machine text.

To run it in a browser

// Fetch and instantiate WebAssembly module
WebAssembly.instantiateStreaming(fetch('module.wasm'))
  .then(result => {
    const exports = result.instance.exports;
    console.log(exports.add(1, 2)); // Call exported function
  });

// From bytes already in memory
const module = new WebAssembly.Module(bytes);
const instance = new WebAssembly.Instance(module, imports);

To run it outside a browser

# Node.js: built in, no flags
node -e "WebAssembly.instantiate(require('fs').readFileSync('module.wasm')).then(m => console.log(m.instance.exports))"

# Standalone runtimes, for WASI-targeted modules
wasmtime module.wasm
wasmer run module.wasm

A module compiled for the browser usually imports functions that only the browser's JavaScript glue code provides; such a file will not run under wasmtime without that glue. A module compiled for WASI runs standalone.

How to Create a WASM File

Rust to WASM

// Cargo.toml
[lib]
crate-type = ["cdylib"]

[dependencies]
wasm-bindgen = "0.2"

// lib.rs
use wasm_bindgen::prelude::*;

#[wasm_bindgen]
pub fn add(a: i32, b: i32) -> i32 {
    a + b
}

cargo install wasm-pack
wasm-pack build --target web      # produces pkg/*.wasm plus JS bindings

C to WASM with Emscripten

// math.c
#include <emscripten.h>

EMSCRIPTEN_KEEPALIVE
int fibonacci(int n) {
    if (n <= 1) return n;
    return fibonacci(n-1) + fibonacci(n-2);
}

emcc math.c -O2 -o math.js    # emits math.js and math.wasm

Other routes

• AssemblyScript: a TypeScript-like language that compiles straight to WASM (asc index.ts -o index.wasm)
• Go: GOOS=js GOARCH=wasm go build -o main.wasm, or TinyGo for much smaller output
• .NET: Blazor WebAssembly compiles C# applications to run in the browser
• Text to binary: wat2wasm module.wat -o module.wasm assembles hand-written WebAssembly text

Development Tools

• Emscripten: C/C++ to WebAssembly compiler
• wasm-pack: Rust to WebAssembly toolchain
• AssemblyScript: TypeScript-like language for WebAssembly
• wabt: WebAssembly Binary Toolkit (wasm2wat, wat2wasm, wasm-objdump, wasm-validate)
• wasm-bindgen: Rust and JavaScript interop
• Binaryen: WebAssembly optimizer (wasm-opt -Oz routinely shrinks modules by 10 to 30 percent)

Runtimes and Environments

• Web browsers (V8, SpiderMonkey, JavaScriptCore)
• Node.js and Deno with WebAssembly support
• Wasmtime and Wasmer (standalone runtimes)
• WASI (WebAssembly System Interface) for file, clock and network access outside the browser
• Cloudflare Workers, Fastly Compute and other edge platforms

Security Features

• Sandboxed execution environment with no ambient access to the host
• Linear memory model with bounds checking
• Control flow integrity: no jumping to arbitrary addresses
• Access to the outside world only through explicitly imported functions
• Capability-based security model under WASI

A .wasm file cannot read your disk, open sockets or run other programs on its own. Whatever it does, it does through the imports its host chose to give it, which is why a module can be inspected safely with wasm-objdump before it is ever run.

Performance Characteristics

• Near-native execution speed for compute-heavy code
• Compact binary format, fast to download and parse
• Streaming compilation: the browser compiles the module while it is still downloading
• Deterministic behaviour across platforms

Best Practices

• Minimise JavaScript/WASM boundary crossings; pass arrays, not many scalars
• Run wasm-opt on release builds
• Serve with Content-Type: application/wasm and long cache headers, since the file is immutable per build
• Use instantiateStreaming rather than fetching the bytes first
• Keep the module small: TinyGo, opt-level = "z" in Rust, and -Oz in Emscripten make a large difference

Related Formats

• JAVASCRIPT: the host language that loads WASM in a browser.
• ELF and PEBIN: the native executable formats WASM parallels, but portable and sandboxed.
• RUST, C and GO: the most common source languages.
• JAVABYTECODE: the older portable-bytecode idea WASM is often compared to.