Built by @ybouane · see also LightFlow · ImageFlow

The fast, safe camera RAW decoder. ▶ Live demo: open a RAW file right in your browser.

Rust core · C, C++, Python and JavaScript bindings · SIMD, all cores and the GPU · runs in the browser

Version 0.1.0 is published on crates.io, PyPI and npm. See docs/packages.md for every package and its install command.

FlashRaw opens a camera RAW file and gives you the sensor data plus everything needed to interpret it (CFA layout, black and white levels, white balance, colour matrices, crops, orientation), the embedded previews, or a display-ready sRGB image. It is written in memory-safe Rust. Of the 2,016 files in the raw.pixls.us corpus, 1,980 decode (98.2%), and 1,965 of them have pinned output hashes; the other 36 are formats it does not support yet or files that are not RAW (28 Nikon High Efficiency NEF, Light L16, Casio CAM, JPEG-in-DNG, a few more: docs/formats.md). On the same machine as the other open-source decoders it is 7.9×–11.4× faster than LibRaw at decoding, 8.8×–15.4× faster at producing an sRGB image, and needs 1.5×–1.9× less memory for it (medians over 62 popular cameras).

Median over the 62 bodies, phones and drones of benches/popular-cameras.tsv, each library on the files it can decode, same files, same machine, all cores. N× faster = the other library's time ÷ FlashRaw's; N× less memory = the other library's peak memory ÷ FlashRaw's.

_{Builds favour the others where possible (LibRaw and RawSpeed with OpenMP and -O3, -march=native on x86-64; the Little CMS transform on all cores; dcraw has no threads). Every number, the method, per-camera and per-format tables, one-thread results, and the cases where FlashRaw is not the fastest (RawSpeed on some uncompressed and Sony lossless files, GoPro GPR; LibRaw on some Canon CR3, rawler on the JPEG XL DNG) and uses more memory (a plain decode on all cores: FlashRaw's parallel decoders keep per-thread buffers) are in docs/benchmarks.md. Reproduce with tools/bench/compare.py.}

To produce an sRGB image FlashRaw develops in one fused pass (demosaic, white balance, colour matrix and sRGB encoding per pixel, straight into the output), so it never holds the full-size intermediate images of a classic pipeline: LibRaw keeps a 4-channel 16-bit working image, the LibRaw + Little CMS pipeline adds a 16-bit RGB copy and the 8-bit output, rawler develops in 32-bit floats. Decoding alone needs about the same memory everywhere (the file plus a 16-bit image); with all cores FlashRaw's speculative parallel decoders add per-thread buffers, so a plain all-core decode can take more memory than LibRaw's (details in docs/benchmarks.md).

Both open camera RAW files with FlashRaw's WebAssembly package, right in the browser.

_{¹ Little CMS is not a RAW decoder: it is compared as the colour-management stage of a typical LibRaw-based pipeline (see the benchmarks above). Checked against the sources and docs of LibRaw 0.22, RawSpeed (develop, c835b05), rawler 0.8.0, dcraw 9.28, rawpy 0.27.1 and Little CMS 2.19.1 (October 2026). Camera counts are not directly comparable: LibRaw counts its own way, the RawSpeed and rawler figures are unique make/model pairs in their camera lists, dcraw's is the size of its colour table. Nikon High Efficiency (TicoRAW) is a proprietary codec no open decoder supports.}

Milliseconds per file on an Apple M1 Ultra (20 cores, macOS), all cores, median of 7 runs, lower is better, bold = fastest. Decode = open + full sensor decode to 16-bit samples. RAW → sRGB = decode + demosaic + white balance + colour conversion to an 8-bit sRGB image (RawSpeed has no RGB pipeline; LibRaw + Little CMS develops to linear ProPhoto RGB and converts it with Little CMS). ❌ = not supported.

The full list (62 bodies, phones, drones and action cameras), the same tables on Linux x86-64, rawpy and dcraw, single-thread results, GPU timings, peak memory per camera and per-format results are in docs/benchmarks.md. Reproduce everything with tools/bench/compare.py; the charts come from tools/bench/charts.py and their numbers are in docs/charts/data.json.

RAW files are untrusted input: they come from the web, from email, from memory cards. FlashRaw is built for that.

• ✅ Memory-safe Rust. Parsing and decoding are safe Rust. unsafe is confined to SIMD intrinsics, zeroed allocation, a disjoint-tile writer, the input self-reference, the WASM clock hook and the mmap call, each with a SAFETY: justification and tests (architecture).
• ✅ Fuzzed. Fifteen cargo-fuzz targets (the whole open/decode pipeline over every format under both corruption policies, the RGB develop path with several outputs, colour spaces and backends, parallel against single-threaded decode, region and tile decode against the full decode, varying resource limits, TIFF and BMFF parsers, bit pumps against a model, Huffman, lossless JPEG, packed unpack, deflate/float, DCT, DNG opcodes, ICC profiles) are run locally before releases (tools/ci/local.sh, 30 s per target; longer runs by hand); there is no continuous fuzzing service. Every crash input is kept and replayed.
• ✅ Malformed-file suite. Truncation at every cut point, invalid offsets and counts, recursive IFDs, overflowing dimensions, broken Huffman tables, corrupted entropy data, garbage behind every magic number, and mutations of a real file of every extension: each must finish without panicking within a time bound (testing).
• ✅ Resource limits. Image sizes are checked against Limits (samples, dimensions) before anything is allocated, so a 20-byte file cannot ask for 64 GB.
• ✅ No silent garbage. Sensor data that runs past the end of the file is recovered with structured warnings or rejected, as you choose (see truncated and corrupt sensor data).
• ✅ Sandboxable. The npm package runs the decoder inside WebAssembly: a decoder bug cannot corrupt the host process.

Support is tracked per format and mode; flashraw supported (and docs/formats.md) lists each with one of these statuses:

Tested by the maintainer with tools/ci/local.sh and tools/ci/mac.sh (the repository has no automatic GitHub workflows): Linux x86-64 and macOS arm64 (Rust, C, Python, npm, WASM). The workflows in .github/workflows/ define builds for Linux ARM64, macOS x86-64 and Windows (wheels, the C library, the LibRaw shim) but run only on manual dispatch and have not been run regularly; Windows paths are untested. See docs/testing.md.

[dependencies]
flashraw = "0.1"

use flashraw::{FlashRaw, DecodeOptions, Backend, OutputFormat};

fn main() -> flashraw::Result<()> {
    let raw = FlashRaw::open_path("photo.NEF")?;          // memory-mapped, headers only

    let m = raw.metadata();
    println!("{} {}x{} ISO {:?}", m.camera(), m.width, m.height, m.exposure.iso);

    // Embedded JPEG preview, zero-copy, without decoding the RAW payload:
    if let Some(p) = raw.preview() {
        std::fs::write("preview.jpg", raw.preview_bytes(p)?)?;
    }

    // Sensor data:
    let frame = raw.decode(DecodeOptions {
        backend: Backend::Auto,
        output: OutputFormat::RawU16,
        ..Default::default()
    })?;
    println!(
        "{}x{} CFA {:?} black {:?} white {:?} via {}",
        frame.width(), frame.height(), frame.cfa, frame.black_level.values,
        frame.white_level.values, frame.stats().backend.decode
    );

    // Display-ready RGBA8 (bilinear demosaic, as-shot WB, colour matrix, sRGB, orientation):
    let rgba = raw.decode(DecodeOptions { output: OutputFormat::Rgba8, ..Default::default() })?;
    Ok(())
}

Input sources: FlashRaw::open(&[u8]) (zero-copy borrow), open(Vec<u8>), open(Arc<[u8]>), open(memmap2::Mmap), open_path(path), from_reader(reader).

Other entry points: decode_region(rect, opts), decode_tile(index, opts), units() (independently decodable tiles/strips with byte ranges), capabilities(), previews() / thumbnail() / decode_preview_rgb(), flashraw::read_metadata(bytes), flashraw::supports(bytes).

Output formats: RawU16 (default), RawF32, NormalizedF32 (black-subtracted, white-scaled), linear sRGB-primaries RGB as LinearRgbF32, LinearRgbF16 (half floats, half the memory) or LinearRgb16, and display-ready sRGB as Rgba8 or Rgb16 (16-bit, orientation applied). RGB outputs take exposure (EV) and black_point / white_point convenience controls. Statistics (frame.stats()) report per-stage timings and the backend that ran.

pip install flashraw

import flashraw

with flashraw.open("photo.NEF") as raw:
    print(raw.metadata.camera.name, raw.metadata.exposure.iso)
    sensor = raw.decode().array                  # numpy uint16 (h, w), zero-copy
    rgba = raw.decode(output="rgba8").array      # numpy uint8 (h, w, 4), display-ready

Decoding releases the GIL, so Python threads decode files in parallel. See docs/python.md.

import { FlashRaw } from "flashraw";

const buffer = await (await fetch("/photo.CR3")).arrayBuffer();
const raw = await FlashRaw.open(buffer);

console.log(raw.metadata.camera, raw.metadata.width, raw.metadata.height);
const preview = await raw.preview();                      // embedded JPEG, instantly
const frame = await raw.decode({ backend: "auto", output: "raw-u16" });
console.log(frame.width, frame.height, frame.cfa, frame.backend, frame.timings);

const img = await raw.decode({ output: "rgba8" });
ctx.putImageData(new ImageData(img.data, img.width, img.height), 0, 0);
raw.close();

See npm/README.md for Node, React/Vite, Web Workers, metadata-only, preview extraction, GPU and CPU fallback examples, and docs/wasm.md.

#include <flashraw.h>

flashraw_file *f = NULL;
if (flashraw_open_path("photo.NEF", NULL, &f) != FLASHRAW_OK) {
    fprintf(stderr, "%s\n", flashraw_last_error_message());
    return 1;
}
flashraw_decode_options o;
flashraw_decode_options_init(&o);
o.output = FLASHRAW_OUTPUT_RGBA8;
flashraw_frame *fr = NULL;
if (flashraw_decode(f, &o, &fr) == FLASHRAW_OK) {
    const uint8_t *rgba = flashraw_frame_data(fr);  /* width x height x 4 bytes */
    flashraw_frame_free(fr);
}
flashraw_file_free(f);

#include <flashraw.hpp>

flashraw::file raw = flashraw::file::open("photo.CR3");   // throws flashraw::error
flashraw::decode_options o;
o.output = flashraw::output_format::linear_rgb_f32;
flashraw::frame img = raw.decode(o);
flashraw::span<const float> rgb = img.f32();             // no copy

Build with cargo build --release -p flashraw-capi or install with CMake (find_package(flashraw), pkg-config). See docs/c-api.md.

flashraw-libraw-compat implements the commonly used part of the LibRaw C API (libraw_init, libraw_open_file, libraw_unpack, libraw_dcraw_process, libraw_dcraw_make_mem_image, …) on top of FlashRaw. Keep your #include <libraw/libraw.h>, recompile against its headers and link -lraw from FlashRaw. See docs/libraw-compat.md for the supported subset and deviations.

cargo install flashraw-cli                          # CPU only: no `gpu` and no `jpegxl` feature
cargo install flashraw-cli --features gpu,jpegxl    # + GPU backend (`--backend gpu`) and JPEG XL DNG
# from a checkout: cargo install --path crates/flashraw-cli [--features gpu,jpegxl]

flashraw info photo.CR3                     # summary (--json for machine output)
flashraw dump-metadata photo.ARW            # everything, as JSON
flashraw decode photo.NEF out.raw           # raw u16 samples (.pgm/.tiff also supported)
flashraw decode photo.RAF out.jpg --output rgba8 --profile
flashraw decode photo.DNG tile.pgm --tile 12
flashraw decode photo.DNG crop.pgm --region 1000,800,512,512
flashraw preview photo.CR2 preview.jpg      # embedded full-size JPEG
flashraw thumbnail photo.CR2 thumb.jpg
flashraw benchmark photo.NEF --iterations 10 --threads 8
flashraw verify photo.ORF --json            # geometry, levels and full-buffer hashes
flashraw verify cut.DNG --json --strict     # fail on truncated data (default: recover + warnings)
flashraw supported                          # format/mode support matrix
flashraw camera-db validate|generate|compare|stats|coverage|crops|probe

Options of decode and benchmark (flashraw decode --help is authoritative): --format, --backend auto|cpu|simd|gpu, --output raw-u16|raw-f32|normalized|linear-rgb|linear-rgb16|linear-rgb-f16|rgba8|rgb16, --region x,y,w,h, --tile N, --threads N, --demosaic bilinear|half, --no-opcodes, --exposure EV, --black-point V, --white-point V, --strict, --preview-fallback, --color-space srgb|display-p3|adobe-rgb|prophoto|rec2020, --output-profile FILE.icc, --intent perceptual|relative|saturation|absolute, --bpc, --profile, --json. Names differ slightly between bindings: docs/api-names.md.

$ flashraw decode photo.DNG out.jpg --output rgba8 --profile
Container parse:             0.05 ms
Pixel unpack:                4.75 ms
Post-process:               28.82 ms
Total:                      34.85 ms

Backend:
  decode: CPU SSE4.1 x16 threads
  postprocess: CPU x16

A strip, tile or other sensor-data range that runs past the end of the file is never silently zero-filled. DecodeOptions::corruption_policy decides what happens:

• CorruptionPolicy::Recover (default): every complete sample is decoded, missing ones are zero, and the frame says so: frame.is_incomplete() and frame.warnings(), each a DecodeWarning with the unit (strip/tile index), the bytes expected and available and the samples filled ("recovered truncated strip 17: 48291 / 131072 bytes available; 41390 missing samples were zero-filled").
• CorruptionPolicy::Strict: the decode fails with Error::CorruptFile; e.truncation() (or e.corrupt_reason()) gives the same details ("truncated image data: strip 17 expected 131072 bytes at offset 24576000, but only 48291 bytes remain before EOF"). e.kind() stays "CorruptFile".

Only the data a decode needs is checked: metadata, previews and region decodes that do not touch the missing data work normally. Short data that still holds every sample is complete: the last row needs no padding to the row stride, and a declared length beyond the last needed sample may run past the end of the file. Recovery covers uncompressed and bit-packed payloads in every format and compressed DNG strips/tiles (a unit that is truncated or fails to decode is zero-filled with a warning), and Nikon and Pentax Huffman and Samsung SRW streams cut short by the end of the file (the rows decoded from real data are kept). Other compressed streams (one entropy-coded stream per image) fail under both policies; when their declared range runs past the end of the file the error carries the same truncation details. A file cut inside its directory structure, before the raw image's IFD, fails with Error::CorruptFile: a thumbnail or preview is never decoded in place of the sensor image.

Sensor data in a codec FlashRaw cannot decode (Nikon High Efficiency NEF) fails with Error::UnsupportedCompression, also for RGB outputs. With DecodeOptions::preview_fallback, Rgba8 and LinearRgbF32 decodes return the embedded full-size preview instead, explicitly marked: frame.source == FrameSource::Preview and a DecodeWarning whose reason is CorruptReason::PreviewFallback. Such a frame is the camera's 8-bit rendering, not sensor data; raw outputs and regions never fall back. The CLI (--preview-fallback), JavaScript (previewFallback), Python (preview_fallback=) and C (flashraw_decode_options.preview_fallback, flashraw_frame_source()) expose the same option.

Build with --features gpu. Packed/uncompressed payloads are unpacked on the GPU; black subtraction, demosaic, white balance, colour conversion and sRGB encoding run as WGSL compute shaders shared by native (Vulkan/Metal/DX12) and browser (WebGPU) builds; results can stay GPU-resident. Backend::Auto only picks the GPU when its measured cost model predicts a win. See docs/gpu.md.

FlashRaw follows semver. The public API is everything documented at the crate root: FlashRaw, Source, DecodeOptions and its enums, RawFrame, the metadata types, Error, and the gpu module (feature gpu).

• Enums that can gain variants (formats, compressions, outputs, backends, errors, stages, preview kinds, ...) are #[non_exhaustive]: match them with a wildcard arm.
• Result and metadata structs (RawFrame, RawMetadata, FrameInfo, DecodeStatistics, Limits, ...) are #[non_exhaustive]: read their fields; build Limits with Limits::default().with_max_samples(..).
• Build DecodeOptions with ..Default::default() (new options are added as fields with backwards-compatible defaults, e.g. corruption_policy).
• Error::CorruptFile and its structured cause (CorruptReason, Truncation, DataUnit) and DecodeWarning are #[non_exhaustive]; read them through their fields and Error::truncation() / Error::corrupt_reason().
• Backend, OutputFormat, Demosaic and CorruptionPolicy implement FromStr/Display with the names the CLI and the JS bindings use.
• Minimum supported Rust version: 1.85 for the library with default features and serde; 1.87 with gpu (and for the CLI and WASM crates); 1.88 with jpegxl. Raising it is a minor-version change.
• Hidden items (low_level, process, decode_raw_image) expose internals for tooling and carry no stability guarantee.

Architecture · Formats · Building and features · Colour management · Benchmarks · GPU · WASM · C and C++ API · LibRaw-compatible API · Python · Packages · Releasing · Names across bindings · Testing · Profiling · Camera DB · Contributing · Security · Decoder contract · For coding agents · References

Code and data (including crates/flashraw-camera-db/data/): MIT OR Apache-2.0, at your option. See LICENSE-MIT and LICENSE-APACHE.

_{Built by @ybouane · Live demo · used in LightFlow and ImageFlow}