wasmtime
A lightweight WebAssembly runtime that is fast, secure, and standards-compliant
A runtime for running WebAssembly code outside the browser on servers or desktops, with a strict security sandbox so untrusted code cannot access the system unless explicitly allowed.
Wasmtime is a standalone runtime for WebAssembly, a technology that lets code compiled from many different programming languages run in a fast, secure, and portable way. WebAssembly (often shortened to Wasm) was originally designed for web browsers, but Wasmtime is designed for running WebAssembly outside the browser — on servers, in desktop applications, or embedded in other programs.
The core appeal of using Wasmtime is that WebAssembly code runs in a strict sandbox, meaning it cannot access the host system (files, network, memory) unless explicitly given permission. This makes it a safe way to run untrusted code or to provide a portable plugin system. Wasmtime is built using the Cranelift code generator, which compiles WebAssembly to native machine code efficiently, either ahead of time or just before execution.
Wasmtime can be embedded in programs written in Rust, C, C++, Python, .NET, Go, Ruby, and other languages through official and community-supported bindings. It also supports WASI, a standard set of interfaces that let WebAssembly programs interact with the file system and other system resources in a controlled, cross-platform way. A command-line tool lets you run Wasm files directly. The project is developed by the Bytecode Alliance, a cross-industry organization working on WebAssembly standards.
Where it fits
- Safely run untrusted plugins in your application by sandboxing them as WebAssembly modules with no system access by default.
- Build a portable plugin system that works across multiple languages by embedding Wasmtime in your Rust or Python project.
- Run WebAssembly programs from the terminal using the Wasmtime CLI tool without writing any embedding code.
- Give WebAssembly code controlled access to specific files or system resources via the WASI standard interfaces.