Can runnable jar files be interpreted back into java source code [duplicate]

Question

When i create a runnable jar file from a java source code file from eclipse, i believe it creates a class file which then can be run by the JVM.

The reason i am asking this is because i am going to be making an java application that keeps all my passwords. The app is going consist of an interface that asks for a password and then if the password is correct show the passwords. Here are my questions on this subject:

• What exactly does a runnable *jar file* consist of?
• If the runnable jar file consists of a class file, can that class file be interpreted in anyway to be able to see the source code which would revile the passwords?
• when you run the runnable jar file from cmd and type "java -jar xxx". and "xxx" meaning the file name, does "-jar" mean you are going to run a jar file and "java" means run this following file in the JVM?
• Is this like .exe files, which can't be un done to readable source code when turned into the .exe file.

Answer 1

For the unasked question: If your password is in the source code it will be in the class file in a pretty easy to find way.

A runnable jar file is a jar file (i.e. zip file with jar suffix) containing class files and special file containing information about which class to start.

You can decompile byte code: http://www.program-transformation.org/Transform/JavaDecompilers to get source code. But you can actually see the password in the byte code without decompiling it

yes. in java -jar xxx java means run the jvm using a jar file with name xxx

If you know the language and tools created you should be able to decompile exe file just as class files. And even if not passwords in the source code will be easy to find in the .exe file. So yes jar files are kind of like exe files, but they are different then what you describe.

If you want to make an application to maintain your passwords, make it so that it encrypts the stored passwords using a master password that you provide on startup as a user of the application. Never ever store passwords in source code.