CFR

CFR is a focused Java bytecode decompiler for developers, analysts, and teams that need local, scriptable inspection of class files and JARs. It suits workflows where free distribution, broad Java-version support, and automation matter more than a graphical reverse-engineering suite. The main trade-off is that difficult inputs can produce poor results, and non-Java JVM code is reconstructed as Java rather than its original language.

Overview

CFR converts Java class files back into Java source and accepts several practical input forms: named class files, classes found on a classpath, or an entire JAR supplied by path. Its command-line interface can write decompiled files to a chosen directory with --outputdir, making repeatable batch processing straightforward for build, analysis, and maintenance workflows.

The maker says CFR can decompile modern Java features, including much of Java 9, 12, and 14. It can also attempt class files produced by other JVM languages. That broadens its usefulness when a JVM project’s original source is unavailable, but the output is always Java, so it will not preserve Kotlin, Scala, or another language’s syntax and idioms. CFR also has edge cases in which the generated source may be poor; it is therefore a tool for understanding and investigation, not a guarantee of faithful source recovery.

Key features

Configurable command-line processing

Command-line options and an options file let users tailor decompilation and keep recurring jobs consistent. This is valuable for scripts and team workflows that need the same settings applied across many files, while users seeking visual navigation will find the command-line focus less convenient.

Java integration

An API has been available since version 0.135, so Java applications can invoke CFR as part of their own processing rather than launching a separate manual operation. The downloadable JAR, Maven distribution, and GitHub repository provide practical installation and integration routes.

Broad runtime compatibility

CFR is written in Java 6 and the maker says it works anywhere Java 6 runs. That can simplify deployment across older or mixed environments, although the decompiler’s output quality still depends on the input and its edge cases.

Pricing

There is no free trial because the product is free rather than trial-based, and there are no paid tiers, seat charges, or stated usage quotas to weigh. That makes CFR a straightforward choice for individuals and teams that can operate a command-line Java tool and do not need commercial licensing terms. The project’s repository identifies the license as MIT. For support, the maker invites problem reports by email and directs bug reports to GitHub; it also asks users not to submit class files whose copyright they do not own.

Platforms

CFR is listed for API use, Linux, macOS, self-hosted deployment, and Windows. Its Java 6 runtime basis and downloadable JAR make local or server-side execution the natural fit, while Maven and the repository support developer-managed installations.

Who it's for

CFR is best for developers inspecting third-party or legacy Java binaries, analysts processing class files in scripts, and teams that need to decompile complete JARs without licensing fees. It is less suitable for investigators who require consistently accurate recovery from every input, for users who need native-code decompilation, or for anyone expecting the original source language when analyzing non-Java JVM bytecode.

Pros and cons

• Pro: Free distribution with an MIT-identified license removes purchase and seat-cost barriers.
• Pro: It handles individual classes, classpaths, and whole JARs, with output directed to a selected directory for automation.
• Pro: Command-line options, option files, and a Java API support repeatable and embedded workflows.
• Pro: The maker targets substantial portions of Java 9, 12, and 14 while retaining Java 6 runtime compatibility.
• Con: Edge cases can yield poor decompilation, so results need review before being treated as source.
• Con: Other JVM languages are emitted as Java, which limits fidelity for language-specific maintenance.
• Con: It does not decompile native code and offers no graphical interface in the described workflow.

Alternatives

For a broader reverse-engineering environment with a free evaluation and education tier covering five decompilation architectures, consider Binary Ninja; its free plan omits API and plugin access, while Personal costs 199.00 USD once.

Boomerang is a free, open-source, BSD-licensed alternative when native-code decompilation is the priority.

Choose IDA Pro when you need professional disassembly and cloud decompilers: IDA Free includes x86-32 and x86-64 disassembly plus two cloud-based decompilers, while IDA Pro Essential costs 1099.00 USD.

JEB fits researchers, students, hobbyists, and nonprofit reverse engineers who want a free Community Edition with x86 and x86-64 decompilation; a free trial is also offered.

rev.ng is worth considering for an open-source decompilation pipeline, with commercial cloud and standalone UI versions planned.

Bytecode Viewer suits users wanting a 100% free, GPL v3 open-source option on desktop platforms.

Ghidra is a free choice for extension-based, cross-platform reverse-engineering work.

ILSpy is another free, open-source option under the MIT License.

Verdict

Choose CFR if you need a free Java decompiler that can process classes and JARs from scripts, integrate through an API, and run across common Java-capable platforms. Look elsewhere when dependable recovery from difficult binaries, original-language output, native-code analysis, or a graphical reverse-engineering suite matters more than CFR’s lightweight command-line and Java focus.