ImHex: Hex Editor for Reverse Engineers and Programmers

What ImHex is

ImHex is a free, open-source hex editor for reverse engineers, programmers and, in the project's own words, "people who value their retinas when working at 3 AM". It is a desktop application for Windows, macOS, Linux and FreeBSD, with a web build that runs in the browser. Beyond viewing and patching bytes, it bundles a custom pattern language for describing binary formats, a node-based data processor, a disassembler, hashing, diffing, YARA scanning and a long list of utility tools.

The problem it solves is familiar to anyone who works with binary data: firmware images, save files, network captures, file formats without good tooling, or corrupted data that needs inspection. A plain hex editor shows bytes; ImHex aims to show what those bytes mean, by letting you describe a format once and then see every structure parsed, highlighted and visualised. Its audience includes reverse engineers, embedded and game developers, people writing parsers and file-format tooling, and anyone debugging binary protocols.

ImHex is written in C++ and its interface is built with Dear ImGui. Most of the code is GPL-2.0-only, with the plugin library under LGPL-2.1.

How it works

At the centre is the hex view, where data from a data source is displayed, searched and patched. Data sources are not limited to local files: the README lists raw disks and partitions, a GDB server (to read the RAM of a running process or embedded device), Intel Hex and Motorola SREC data, Base64-encoded data, raw UDP packets, the address space of a running process, and remote files over SSH with SFTP. Large files are loaded efficiently, and a paged view keeps navigation usable.

On top of the hex view sits the Pattern Language, a custom C++-like language developed for ImHex. You declare structs, unions, enums, bitfields, arrays and pointers with endianness and conditionals, and ImHex parses the file accordingly, highlights each field and can visualise values as images, audio, 3D models, coordinates or timestamps. Patterns load automatically based on MIME types and magic values. A shared database, the ImHex-Patterns repository, collects format patterns, libraries, magic files and constants, and a built-in content updater downloads them from inside the app.

The data processor is a node graph that can modify, decrypt or decode data before it is shown in the editor, without touching the underlying source. ImHex is also extensible through plugins built against libimhex and a plugin SDK.

Key features

• Full-featured hex view: byte patching with patch management, unlimited undo and redo, configurable highlighting, multiple display formats and custom encodings including UTF-8, UTF-16 and ShiftJIS.
• Copy as code: copy a selection as a C, C++, C#, Rust, Python, Java or JavaScript array, a hex string or a self-contained HTML block.
• Data inspector: interpret bytes as integers of many widths, floats, LEB128, strings, DOS and Unix timestamps, GUIDs and colours, with endianness switching, and add new types through the pattern language.
• Search: string extraction, byte sequences, regular expressions, binary patterns with wildcards and numeric values or ranges.
• Hashing: CRC variants with custom polynomials, MD5, the SHA family, xxHash, Murmur, SipHash, BLAKE2 and many more, over regions or arbitrary strings.
• Diffing: compare data from different sources with highlighted and tabular differences.
• Integrated disassembler: based on Capstone, covering ARM, ARM64, MIPS, x86, PowerPC, RISC-V, WebAssembly and others, with support for custom disassemblers.
• Analysis and visualisation: magic-based file detection, byte distribution and entropy graphs, and detection of encrypted or compressed regions.
• YARA rules: scan data with YARA rules, highlight matches and jump between them.
• Utilities: demanglers for Itanium, MSVC, Rust and D, a calculator and graphing calculator, base converter, IEEE 754 float visualiser, file splitter and combiner, a TCP client/server and HTTP requests.
• Interface: dark mode by default with a light theme, shareable theme files, custom fonts, multiple workspaces, custom layouts, detachable windows, translations, a simplified mode for beginners and interactive tutorials.

Getting started

The simplest route is a release from the GitHub Releases page: an installer or portable zip on Windows, a DMG on macOS, and AppImage, Flatpak, Snap, DEB, RPM and Arch packages on Linux. From the install guide, on Windows:

winget install WerWolv.ImHex

On Linux via Flathub:

flatpak install flathub net.werwolv.ImHex

For a downloaded AppImage:

chmod +x imhex-*.AppImage
./imhex-*.AppImage

Fedora users can install the distribution package with dnf install imhex, and Chocolatey users with choco install imhex. There is also a browser version at web.imhex.werwolv.net. To build the plugin SDK from source, the README gives:

cmake -G Ninja -DIMHEX_BUNDLE_PLUGIN_SDK=ON -B build

Clone with --recurse-submodules, because many dependencies are bundled as submodules.

Use cases

• File-format reverse engineering: write a pattern for an undocumented format and iterate while watching fields highlight in place.
• Embedded and firmware work: load Intel Hex or SREC images, read device memory through a GDB server, and disassemble code for ARM or MIPS targets.
• Debugging serialisation code: inspect the bytes a program writes, compare two outputs with the diff view and check checksums with the hashing tools.
• Binary triage: use entropy graphs and encrypted or compressed file detection to spot unusual regions, and scan files with YARA rules.
• Binary patching: patch values with full undo history, export IPS or IPS32 patches and copy byte ranges as source-code arrays.

How it compares

Simple hex editors such as the ones bundled with many IDEs cover viewing and patching. ImHex sits closer to dedicated binary analysis tools because of its pattern language, data processor and disassembler, while still being a general-purpose editor. Full reverse-engineering suites like Ghidra focus on decompiling programs; ImHex focuses on raw data and formats, and the two are often used side by side. Its main differentiators are the Pattern Language with a community pattern database, and the breadth of data sources it can attach to.

Things to know before adopting

• GPU requirement: ImHex needs OpenGL 3.0. Software-rendered -NoGPU releases exist but can be much slower, and some Intel integrated GPU drivers on Windows are known to cause graphical artifacts.
• macOS builds: release binaries need macOS 15 (Sequoia) or later and are not signed, so they must be allowed manually in security settings. Older macOS versions require compiling from source.
• Compilers: building needs GCC or LLVM Clang with C++23 support; MSVC and AppleClang are not supported.
• Licence: GPL-2.0-only for most of the code, so distributing modified versions requires releasing source under the same terms. libimhex and the UI plugin library are LGPL-2.1 specifically so proprietary plugins can be built.
• Network behaviour: the code-signing policy states the program will not transfer information to other networked systems unless the user requests it.
• Resource needs: around 50 MiB of RAM and 100 MiB of storage, more for complex analysis.

Project activity

As of October 2026 the repository has about 55,400 stars. It was created in November 2020, is written in C++ and is licensed under GPL-2.0, with recent pushes in October 2026. Windows builds are code-signed through SignPath, and the project lists JetBrains, SignPath and AWS as sponsors. Source is at github.com/WerWolv/ImHex, with documentation at docs.werwolv.net and downloads at imhex.werwolv.net.