macOS
Homebrewverified · 100%
brew install cfr-decompilerlocal Homebrew formula metadata
brew
Install cfr-decompiler with Homebrew
Yet Another Java Decompiler. Version 0.152 via Homebrew; verified 2026-06-22.
install
Additional install commands
overview
Package summary
Yet Another Java Decompiler
Project links
Commands and aliases
- cfr-decompiler
history
Project history and usage
CFR is a Java bytecode decompiler distributed as the `cfr-decompiler` Homebrew formula. Its official site describes it as another Java decompiler that can handle modern Java features while being written in Java 6 for broad runtime compatibility.
Project history
The official GitHub repository was created in May 2014 and points users to benf.org as the main CFR site. The README says CFR can decompile modern Java features, including Java 9, 12, and 14 features, and can make a reasonable attempt at JVM languages such as Kotlin, Scala, and Groovy.
The benf.org project page records a long release history, including 0.146 in July 2019, 0.147 in October 2019, 0.150 in May 2020, 0.151 in February 2021, and 0.152 in December 2021. The README notes that since 0.145, binaries have also been published on GitHub releases.
Adoption history
CFR's adoption comes from the Java reverse-engineering and debugging niche: developers use it when they need readable Java-like output from class files or jars, especially for newer language features that older decompilers may not handle cleanly.
Official distribution includes the benf.org jar downloads, GitHub release artifacts, and Maven Central. The Homebrew package wraps that Java tool in a package-manager-friendly executable for macOS users.
How it is used
The documented use is to run the versioned jar against class names or class files, or pass an entire jar and an `--outputdir` when emitting files. The README also documents `--help` for arguments.
CFR supports an options file for decompilation tests, but the official user docs do not document a persistent application config path or credential file for normal CLI use, so both locations are null.
Why package nerds care
CFR matters to package people because decompilers are operational tools as much as developer tools: they are installed when source is missing, artifacts are suspicious, or bytecode behavior needs inspection.
It is also a classic example of a small Java jar that package managers wrap into a named executable. The package value is not dependency complexity; it is putting a known decompiler on PATH.
Timeline
- 2014: The leibnitz27/cfr public repository is created on GitHub.
- 2019: CFR 0.146 and 0.147 add support and fixes for Java and Kotlin bytecode patterns.
- 2021: CFR 0.152 is published on benf.org with support and fixes for newer Java features including sealed classes.
- 2026: The official site notes renewed tinkering and points users to the GitHub repository for a modern version.
Related projects
- The Java compiler and JVM class-file format are the direct targets CFR decompiles.
- Kotlin, Scala, and Groovy are named in the README as JVM languages whose class files CFR may attempt to turn back into Java.
- Maven Central is an official distribution channel for CFR artifacts.
Sources
security posture
Risk level: green
narrow executable package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- narrow executable package without higher-risk signals
Signals
- metadata:no-higher-risk-signals
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Installs with 1 runtime dependencies.
- Build metadata lists 1 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
cfr-decompiler | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version0.152
manager updated2026-06-22
local dataok
upstreamnot checked
latest detectednot detected
https://github.com/leibnitz27/cfr
- infoNo cached GitHub release or tag data was available.https://github.com/leibnitz27/cfrnone confidence
install metadata
Package metadata
| Package key | brew:cfr-decompiler |
|---|---|
| Version | 0.152 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/cfr-decompiler |
| Homepage | https://www.benf.org/other/cfr/ |
| Repository | https://github.com/leibnitz27/cfr |
| Upstream docs | https://github.com/leibnitz27/cfr#readme |
| License | MIT |
| Source archive | https://github.com/leibnitz27/cfr.git |
| Last updated | 2026-06-22T14:03:00-07:00 |
| Pulse | updated |
| Dependencies | openjdk@21 |
| Build dependencies | maven |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | cfr-decompiler |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- package relationship graph
- package version freshness
- package-page enrichment