True: compiling is obfuscation, not encryption but, the same argument applies to Java, VB, etc. Even compiled C++ can be disassembled. Anyway, web2py inlines some stuff before bytecode compiling so if you decompile a compiled web2py app you do not get a valid web2py app (because there is no one to one match between modules) unless you tweak it. In most of the cases it is not worth the task.