Can someone decompile my .NET app? Stopping dnSpy and ILSpy

If you’ve ever wondered whether someone can decompile your .NET app: they can, easily, with free tools. Here’s how it works and what to do about it.

How decompilation works

.NET compiles to IL, which preserves names and structure. Decompilers reverse that:

• ILSpy / dotPeek — open a .dll/.exe and show reconstructed C#.
• dnSpy — goes further: it decompiles and lets an attacker set breakpoints, edit IL, and patch your assembly live. It’s a favorite for defeating naive license checks — find the if (isLicensed), flip it, save.

Out of the box, none of this requires skill. That’s the problem obfuscation and hardening solve.

Making your assembly hard to read

• Identifier renaming strips the readable names dnSpy/ILSpy display.
• Control-flow flattening turns clean methods into dispatcher state machines, so the decompiled output no longer resembles your logic.
• String encryption removes the literal strings that make code easy to navigate and search.

Making your assembly hard to debug and patch

Reading is only half of it — dnSpy’s real power is interactive tampering. To counter that:

• Anti-debug detects when a debugger like dnSpy is attached and lets you react (exit, throw, or a custom response).
• Anti-tamper detects when your assembly has been modified after signing, so a patched binary can refuse to run.

Together these stop the “attach dnSpy, patch the check, save” attack that trivially defeats unprotected apps.

A word on license checks specifically

If your app has any licensing or “pro feature” gating, the check itself is the target. An unprotected if (license.IsValid) is one dnSpy edit away from being bypassed. Obfuscating the check and adding anti-tamper is what makes it hold up. (More on this in protecting .NET license checks.)

Putting it together

The practical answer to “can someone decompile my .NET app?” is: yes by default, but you can make it far more trouble than it’s worth. Obfuscate and harden your Release build, verify it still runs identically, sign it, and ship.

Nebula.NET provides renaming, control-flow flattening, string encryption, and anti-tamper/anti-debug across .NET Framework 4.8 and .NET 6–10 — try the free edition and open the result in ILSpy to see the difference yourself. Weighing your options first? Compare the best .NET obfuscators of 2026.