WebBuilding

Languages and formats

WebAssembly

Summary

WebAssembly (Wasm) is a compact binary code format that lets programs written in languages such as C, C++ and Rust run in web browsers at close to native speed, alongside JavaScript. Brendan Eich announced it on June 17, 2015, Firefox and Chrome turned it on by default in March 2017, and the W3C made it a Recommendation on December 5, 2019. Version 3.0 was completed on September 17, 2025.

Web Building Encyclopedia · Languages and formats · Last reviewed October 22, 2026 · 10 min read

What WebAssembly is

WebAssembly, usually shortened to Wasm, is a compact binary format for computer code. The project’s own site defines it as “a binary instruction format for a stack-based virtual machine,” designed as a portable compilation target for programming languages.1 A virtual machine here means an imaginary computer that the real one imitates, so the same code can run on any processor.

People rarely write WebAssembly by hand. They write in a language such as C, C++ or Rust, and a compiler turns that program into a .wasm file. One compiler, AssemblyScript, takes a strict variant of TypeScript, which suits web developers.2 A web browser downloads the file, checks it and translates it into instructions for the visitor’s own processor.

When the World Wide Web Consortium (W3C) made WebAssembly an official standard on December 5, 2019, it called it the fourth language for the web, after HTML, CSS and JavaScript.3 It does not replace JavaScript. Mozilla’s developer documentation says it is designed to work alongside JavaScript and complement it, and JavaScript decides when Wasm code is downloaded, compiled and run.2

The specification sets out the main design goals. Wasm should run at close to the speed of native code, run inside a sandbox that keeps it from damaging the rest of the system, and work the same on any hardware, language or platform. Its binary format should be small to send and quick to decode, and a browser should be able to start compiling it before the whole file has arrived.4 The core specification makes no assumptions about the web, so the same format can also run outside browsers.4

Before WebAssembly: plug-ins, asm.js and Native Client

For years, the usual way to run fast compiled code on a web page was a browser plug-in such as Adobe Flash. Browser makers then tried several ways to get similar speed from the open web platform itself.

asm.js

The most direct ancestor of WebAssembly is asm.js, which its specification describes as “a strict subset of JavaScript” meant as a low-level, efficient target for compilers. Its editors were David Herman, Luke Wagner and Alon Zakai of Mozilla.5 Because asm.js was ordinary JavaScript, it ran in any browser. A browser that recognized it could compile it ahead of time for extra speed.

Mozilla added OdinMonkey, an asm.js optimizer, to Firefox Nightly in March 2013, and enabled it by default starting with Firefox 22. Wagner’s announcement set the goal of running within twice the time native code takes. It showed C and C++ code being compiled to asm.js with the Emscripten toolchain.6 Mozilla later credited Wagner with creating asm.js and leading the WebAssembly specification work.7

asm.js had limits. Brendan Eich, the creator of JavaScript, wrote in 2015 that for large programs the parser, the part of the engine that reads the source text, becomes the bottleneck, especially on mobile devices.8

Native Client

Google took a different route with Portable Native Client (PNaCl), a sandbox introduced in 2013 that let web apps run native code without plug-ins. It worked well in Chrome but did not work consistently in other browsers.9 On May 30, 2017, Google announced that it would remove PNaCl support in the first quarter of 2018, outside Chrome Apps and Extensions, and pointed developers to WebAssembly as the cross-browser replacement.9

From announcement to standard, 2015 to 2019

Eich announced WebAssembly on his blog on June 17, 2015. He described it as “a new binary syntax for low-level safe code,” able at first to express the same programs as asm.js, so that a JavaScript polyfill (code that imitates a missing feature) could run Wasm in older browsers.8 He wrote that the work, organized as an open W3C Community Group, had been a joint effort among Google, Microsoft, Mozilla and a few others.8

On October 31, 2016, the V8 team at Google announced a browser preview, released together with Firefox and Edge. The design came from collaborators at Google, Mozilla, Microsoft and Apple, and the Community Group planned an official specification for the first quarter of 2017.10

The first browsers turned WebAssembly on by default in March 2017:

  • Firefox 52, released on March 7, 2017, added support for WebAssembly.11
  • Chrome 57, which the V8 team said would be the first Chrome release to enable WebAssembly by default, reached the stable channel on March 9, 2017.1213
  • Safari 11 shipped WebAssembly support for x86-64 and ARM64 processors, announced on the WebKit blog on September 22, 2017.14
  • Edge 16 is the first version of Microsoft Edge that Can I use lists as supporting WebAssembly.15 On November 13, 2017, Mozilla reported that, with Apple and Microsoft shipping support, WebAssembly now ran in all four major browsers.7

The W3C’s first charter for a WebAssembly Working Group began on August 3, 2017.16 Its WebAssembly Core Specification appeared as a First Public Working Draft on February 15, 2018, became a Candidate Recommendation on July 18, 2019 and a W3C Recommendation, the W3C’s term for a finished standard, on December 5, 2019.17 The press release listed uses such as video and audio codecs, graphics and 3D, games, cryptography and portable language implementations.3

WebAssembly was also part of the case for retiring plug-ins. When Adobe announced in July 2017 that it would stop updating and distributing Flash Player at the end of 2020, it said open standards such as HTML5, WebGL and WebAssembly had matured.18 The end of Adobe Flash entry covers that transition.

How WebAssembly works

The binary format and the text format

Every .wasm file begins with four identifying bytes, called the magic number, which spell \0asm, followed by a version field. As of October 2026, the specification says the current version of the binary format is 1, even after the language releases 2.0 and 3.0.19 The rest of the file is divided into numbered sections that hold types, imports, functions, memory, exports and code.19

There is also a text format, saved in .wat files, so that people can read and edit modules. It writes a module as nested lists in parentheses, called S-expressions. Execution is defined as a stack machine: each instruction pushes values onto a stack or takes them off.20 In MDN’s example, a function that adds two 32-bit integers is three instructions: local.get $lhs, local.get $rhs and i32.add. The tool kit called wabt converts .wat text into a .wasm binary.20

Modules, memory and JavaScript

Mozilla’s documentation describes four core pieces:2

  • Module: a compiled Wasm binary. Like a JavaScript module, it declares imports and exports.
  • Memory: a growable block of bytes that the code reads and writes, called linear memory.
  • Table: a growable list of references, such as references to functions, that cannot be stored as raw bytes.
  • Instance: a module together with its memory, tables and imported values, ready to run.

Wasm code and JavaScript can call each other. Exported Wasm functions appear in JavaScript as normal functions.2 On its own, WebAssembly cannot reach the page’s elements (the DOM). It calls JavaScript, which then calls the browser’s APIs, so toolchains such as Emscripten generate JavaScript glue code for that job.2 Emscripten describes itself as a complete open-source compiler toolchain to WebAssembly for C, C++ and other languages built on the LLVM compiler, and lists Unreal Engine 4, the Unity engine and the Qt framework among the code it has ported.21

The fastest way to load a module is WebAssembly.instantiateStreaming(), which compiles the file while it downloads. It only works if the web server sends the file with the application/wasm media type; otherwise the browser rejects it with an error.22

The security model

Each module runs in a sandbox, separated from the host and able to act only through the functions the host gives it. In a browser it follows the same rules as JavaScript, including the same-origin policy, which stops a page from reading data that belongs to another site.23 Memory accesses are checked against the bounds of the module’s memory, and calls can only go to valid functions, which blocks the classic trick of injecting new code.23

The sandbox protects the browser, not the program inside it. The project’s security page notes that bugs within a module can still overwrite neighboring data in its own memory, and that side-channel attacks such as timing attacks remain possible.23

Versions 2.0 and 3.0

After the 1.0 standard, new features went through the Community Group’s proposal process and were gathered into numbered releases.

Wasm 2.0 was finished by the Community and Working Groups in early 2022, and major engines shipped it well before it became official.24 It added 236 vector instructions for 128-bit SIMD (single instruction, multiple data, which processes several numbers at once), faster bulk copying of memory, functions that return several values, and reference types.24 The W3C published it as a First Public Working Draft on April 19, 2022 and as a Candidate Recommendation on December 17, 2024.25 The Working Group then moved to an evergreen model: the Candidate Recommendation is updated in place with each new release instead of moving on to final Recommendation status.24

Wasm 3.0 was announced as complete on September 17, 2025. Its main additions are:26

  • 64-bit memory. The address space grows from 4 GB to a theoretical 16 exabytes, though on the web a 64-bit memory is limited to 16 GB.
  • Garbage collection. The engine can manage memory for structures and arrays, so languages such as Java, OCaml, Scala, Kotlin, Scheme and Dart can compile to Wasm without bringing their own memory manager.
  • Exception handling and tail calls. Native support for exceptions, and calls that do not use up extra stack space.
  • Multiple memories, typed references and relaxed vector instructions, plus JS string builtins, which let Wasm code work directly with JavaScript strings.

Garbage collection reached browsers before the 3.0 release was declared. Google enabled it by default in Chrome 119 in 2023, noting that a language ported to Wasm, such as PHP, otherwise had to ship a second garbage collector alongside the browser’s own, which was “as wasteful as it sounds.”27 Safari added it in version 18.2, announced on December 9, 2024.28 As of October 2026, the W3C’s latest Candidate Recommendation Draft, dated October 13, 2026, describes release 3.0 of the core standard.29

Beyond the browser: WASI and server-side Wasm

Because the core format is not tied to the web, Wasm also runs in server software, command-line tools and cloud platforms. Node.js, the server-side JavaScript runtime, provides the APIs for running Wasm through a global WebAssembly object.30 Node’s own guide notes that a module cannot use operating system features by itself, and points to a third-party runtime, Wasmtime, that provides them through WASI.30

WASI, the WebAssembly System Interface, was announced in March 2019 as a standard way for Wasm programs to reach files, network connections and other system resources. It uses capability-based security: a program can only open the files and folders the host has handed it.31 In November 2019, Mozilla, Fastly, Intel and Red Hat founded the Bytecode Alliance to build a “secure by default” foundation for running Wasm outside the browser.32

The WASI Subgroup voted on January 25, 2024 to launch WASI 0.2, which is built on the Wasm component model, a way of joining modules written in different languages. It defined two “worlds”: wasi-cli, roughly matching the POSIX command-line environment, and wasi-http, for programs that handle web requests.33 As of October 2026, wasi.dev lists three milestone releases, 0.1, 0.2 and 0.3, with 0.3 adding asynchronous support to the component model.34

How the web uses WebAssembly

Several well-known web applications use WebAssembly to bring code first written for desktop software into the browser:

  • Figma. The design tool’s product is written in C++. In 2017, Figma’s co-founder Evan Wallace reported that moving from asm.js to WebAssembly cut load time by more than three times, and that Wasm parsed about 20 times faster than asm.js.35
  • Photoshop. Adobe brought its C++ code to the browser with Emscripten instead of rewriting it in JavaScript. It needed WebAssembly threads and worked with the Community Group on C++ exception handling. A 2021 web.dev article reported that SIMD gave a 3 to 4 times speedup on average for its image-processing code.36
  • .NET apps. Microsoft released Blazor WebAssembly 3.2.0 on May 19, 2020, describing it as ready for production use. It runs a .NET runtime compiled to Wasm, so C# code runs in the browser without plug-ins.37
  • Python. Pyodide is “a Python distribution for the browser and Node.js based on WebAssembly.”38 The Python entry describes it further.

On ordinary websites, WebAssembly is still rare. The HTTP Archive’s 2025 Web Almanac, based on a July 2025 crawl, found Wasm on 0.35% of desktop sites and 0.28% of mobile sites, about 43,000 sites in all.39 The median module was 14 KB, while the largest desktop file was 234 MB. Among the source languages the chapter could identify, .NET (including Blazor) was the most common, with a 41.7% share on desktop.39

Not every use has been welcome. A study of the Alexa top 1 million websites, based on a December 2018 list, found that about 1 in 600 sites ran Wasm code and that over half of those used it for malicious purposes, such as mining cryptocurrency in visitors’ browsers or hiding code.40

Timeline

  1. The 2025 Web Almanac finds WebAssembly on 0.35% of desktop sites39
  2. Wasm 3.0 is announced as complete, adding garbage collection and 64-bit memory26
  3. The W3C publishes Wasm 2.0 as a Candidate Recommendation25
  4. The WASI Subgroup votes to launch WASI 0.2, based on the component model33
  5. Chrome 119 enables WebAssembly garbage collection by default27
  6. The WebAssembly Core Specification becomes a W3C Recommendation3
  7. Mozilla, Fastly, Intel and Red Hat found the Bytecode Alliance32
  8. WASI, a system interface for running Wasm outside the web, is announced31
  9. Mozilla reports WebAssembly support in all four major browsers7
  10. The W3C WebAssembly Working Group's first charter begins16
  11. Chrome 57 reaches stable with WebAssembly on by default13
  12. Firefox 52 ships with WebAssembly support11
  13. Brendan Eich announces WebAssembly8
  14. Luke Wagner announces asm.js optimization in Firefox Nightly6

What it means for your website

Most small business websites never use WebAssembly directly. Pages made with HTML, CSS and JavaScript, and sites on a hosted builder or WordPress, run fine without it. It matters when you add a heavy tool to your site, such as a 3D product viewer, an image editor, a game or an in-browser calculator built in another language.

  • Browser support is not the problem. As of October 2026, Can I use counts 97.24% of global browser usage as supporting WebAssembly.15
  • Check the server settings. Your host must send .wasm files as application/wasm, or the fastest loading method fails.22 The 2025 Web Almanac found missing or wrong types on 3.2% of desktop Wasm requests. It also found Brotli the most common compression for Wasm files (78.1% on desktop), so ask your host to compress them too.39 Our glossary entry on web hosting explains what a host controls.
  • Watch the file size. The median module is 14 KB, but some run to hundreds of megabytes.39 A large download on your home page can slow first load and hurt your Core Web Vitals. Load heavy tools only on the page that needs them.
  • Know what third-party scripts run. A 2019 study, based on a December 2018 list of top sites, found that over half of the sites using Wasm used it for malicious purposes, such as cryptocurrency mining.40 Review the widgets and plugins you add, and remove any you cannot explain.
  • Keep the code inside updated. The sandbox protects the visitor’s device, but bugs inside a module can still corrupt its own data.23 Update Wasm-based tools like any other software.

For how the pieces of a site fit together, from browser to server, see our guide to how a website works.

See also

References

  1. WebAssembly. WebAssembly Community Group, webassembly.org. accessed October 22, 2026.
  2. WebAssembly concepts. MDN Web Docs, Mozilla. accessed October 22, 2026.
  3. World Wide Web Consortium (W3C) brings a new language to the Web as WebAssembly becomes a W3C Recommendation. W3C press release. 2019-12-05. accessed October 22, 2026.
  4. Introduction, WebAssembly Specification (release 3.0). WebAssembly Community Group and Working Group. accessed October 22, 2026.
  5. asm.js: Working Draft. David Herman, Luke Wagner and Alon Zakai, asmjs.org. 2014-08-18. accessed October 22, 2026.
  6. asm.js in Firefox Nightly. Luke Wagner, blog.mozilla.org. 2013-03-21. accessed October 22, 2026.
  7. WebAssembly support now shipping in all major browsers. Judy McConnell, The Mozilla Blog. 2017-11-13. accessed October 22, 2026.
  8. From ASM.JS to WebAssembly. Brendan Eich, brendaneich.com. 2015-06-17. accessed October 22, 2026.
  9. Goodbye PNaCl, Hello WebAssembly. Brad Nelson, Chromium Blog. 2017-05-30. accessed October 22, 2026.
  10. WebAssembly browser preview. V8 team, v8.dev. 2016-10-31. accessed October 22, 2026.
  11. Firefox 52.0 release notes. Mozilla. 2017-03-07. accessed October 22, 2026.
  12. V8 release v5.7. V8 team, v8.dev. 2017-02-06. accessed October 22, 2026.
  13. Stable Channel Update for Desktop. Chrome Releases, Google. 2017-03-09. accessed October 22, 2026.
  14. New WebKit Features in Safari 11. WebKit blog. 2017-09-22. accessed October 22, 2026.
  15. WebAssembly. Can I use. accessed October 22, 2026.
  16. WebAssembly Working Group: charters. W3C. accessed October 22, 2026.
  17. WebAssembly Core Specification: history. W3C. accessed October 22, 2026.
  18. Flash & The Future of Interactive Content. Adobe. 2017-07-25. accessed October 22, 2026.
  19. Modules (binary format), WebAssembly Specification. WebAssembly Community Group and Working Group. accessed October 22, 2026.
  20. Understanding WebAssembly text format. MDN Web Docs, Mozilla. accessed October 22, 2026.
  21. About Emscripten. Emscripten project, emscripten.org. accessed October 22, 2026.
  22. WebAssembly.instantiateStreaming(). MDN Web Docs, Mozilla. accessed October 22, 2026.
  23. Security. WebAssembly Community Group, webassembly.org. accessed October 22, 2026.
  24. Wasm 2.0 Completed. Andreas Rossberg, webassembly.org. 2025-03-20. accessed October 22, 2026.
  25. WebAssembly Core Specification (wasm-core-2): history. W3C. accessed October 22, 2026.
  26. Wasm 3.0 Completed. Andreas Rossberg, webassembly.org. 2025-09-17. accessed October 22, 2026.
  27. WebAssembly Garbage Collection (WasmGC) now enabled by default in Chrome. Thomas Steiner, Chrome for Developers, Google. 2023-10-31. accessed October 22, 2026.
  28. WebKit Features in Safari 18.2. WebKit blog. 2024-12-09. accessed October 22, 2026.
  29. WebAssembly Core Specification, Candidate Recommendation Draft. W3C WebAssembly Working Group. 2026-10-13. accessed October 22, 2026.
  30. Node.js with WebAssembly. Node.js project, nodejs.org. accessed October 22, 2026.
  31. Standardizing WASI: A system interface to run WebAssembly outside the web. Lin Clark, Mozilla Hacks. 2019-03. accessed October 22, 2026.
  32. Announcing the Bytecode Alliance: Building a secure by default, composable future for WebAssembly. Lin Clark, Mozilla Hacks. 2019-11. accessed October 22, 2026.
  33. WASI 0.2 Launched. Dan Gohman, Bytecode Alliance. 2024-01-25. accessed October 22, 2026.
  34. WASI. WASI Subgroup, W3C WebAssembly Community Group, wasi.dev. accessed October 22, 2026.
  35. WebAssembly cut Figma's load time by 3x. Evan Wallace, Figma blog. 2017. accessed October 22, 2026.
  36. Photoshop's journey to the web. Nabeel Al-Shamma and Thomas Nattestad, web.dev, Google. 2021. accessed October 22, 2026.
  37. Blazor WebAssembly 3.2.0 now available. Daniel Roth, .NET Blog, Microsoft. 2020-05-19. accessed October 22, 2026.
  38. Pyodide. Pyodide project. accessed October 22, 2026.
  39. WebAssembly, 2025 Web Almanac. Nimesh Vadgama, HTTP Archive. 2026-01-15. accessed October 22, 2026.
  40. New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild (DIMVA 2019). Marius Musch, Christian Wressnegger, Martin Johns and Konrad Rieck, TU Braunschweig. 2019. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].