Wuffs
Hacker ApprovedShares rank 91 of 163 programming languages by recommenders
Recommended for writing memory-safe file decoders that run fast, since the compiler proves safety without runtime bounds checks. Caveat: programs take longer to write because of explicit safety proofs.
Recommended for writing memory-safe file decoders that run fast, since the compiler proves safety without runtime bounds checks. Caveat: programs take longer to write because of explicit safety proofs.
13 people gave an opinion
- recommend it
- 12
- criticize it
- 1
- approval share
- 92%
Recommended in 8 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 12 people recommend itNeeds 10 or more, met.
- 12 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 8 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
No runtime bounds checks
“WUFFS illustrates that if we're willing to give up generality we can have a language which is entirely safe but doesn't do runtime bounds checks”
Comment from 22 Oct 2026 in “Rust Style Guide” “it isn't emitting bounds checks it just checks that you proved you don't have bounds misses”
Comment from 21 Jun 2026 in “Linux Eliminates the Strncpy API After Six Years of Work, 360 Patches” Safety checked at compile time
“It has compile-time spatial memory safety, where Rust has compile-time temporal safety but runtime spatial safety”
Comment from 13 Nov 2025 in “Rust in Android: move fast and fix things” “WUFFS is able to guarantee safety of the codec at compile time”
Comment from 4 Oct 2026 in “Memory-Safe WebP Decoding” “all of the safety in WUFFS was checked during compilation”
Comment from 26 Jul 2026 in “Memory Safety Absolutists” Fast, sometimes rivals handwritten code
“WUFFS provides strong concrete evidence. A WUFFS image decoder is entirely safe because that was the whole point, but it's also a lot faster”
Comment from 21 Aug 2026 in “The case against a C alternative (2022)” “WUFFS can actually rival handwritten implementations in certain cases.”
Comment from 31 May 2026 in “Dav2d” “you'll see benchmarks very favorably comparing to rust implementations”
Comment from 14 Nov 2025 in “Rust in Android: move fast and fix things” - Comment from 13 Jun 2026 in “Twenty One Zero-Days in FFmpeg”
Suggested for safe parser design
“really this kind of problem screams out for the approach taken in WUFFS”
Comment from 16 Nov 2025 in “Denial of Fuzzing: Rust in the Windows Kernel” “we should use a language purpose-built to do that safely”
Comment from 29 Oct 2026 in “The case of the 9 bit AES key” “replace all parsers with something at least as safe as”
Comment from 18 Sep 2026 in “A heap overflow and SSO misconfiguration to compromise OpenAI internal repos” - Comment from 2 Sep 2026 in “Casey Muratori – The Root of the Root of All Evil – BSC 2026 [video]”
- Comment from 17 Apr 2026 in “A simplified model of Fil-C”
Other programming languages people recommend
The four most recommended other programming languages, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 163 programming languages, rankedWhat people said
27 of the 29 comments that mention it, newest first. Each links to the original comment.
“Just that WUFFS is the appropriate technology.”
“we should use a language purpose-built to do that safely”
“the same organization that does wuffs”
“WUFFS illustrates that if we're willing to give up generality we can have a language which is entirely safe but doesn't do runtime bounds checks”
“WUFFS is able to guarantee safety of the codec at compile time”
“But we literally do already have WebP for WUFFS.”
“A WUFFS codec is obviously going to be a lot faster than Fil-C for similar development effort”
“Wuffs does still have a stronger formal property”
“Wuffs is a zero-capability language. It's a language for writing (safe) libraries, that only compute.”
“performance is not as good as libwebp yet, but landing the SIMD parts should fix that”
“replace all parsers with something at least as safe as”
“you probably want something like WUFFS”
“WUFFS provides strong concrete evidence. A WUFFS image decoder is entirely safe because that was the whole point, but it's also a lot faster”
“WUFFS requires that processing a chunk of N items has code to process one at a time, which means it'll work for any N.”
“all of the safety in WUFFS was checked during compilation”
“it isn't emitting bounds checks it just checks that you proved you don't have bounds misses”
“languages which do more, and more, and more checking pay off very well”
“wuffs is safer and also often faster”
“Wuffs usually comes up in this context”
“WUFFS can actually rival handwritten implementations in certain cases.”
“For example if you attempt an equivalent mistake in WUFFS that will be rejected.”
“languages like WUFFS deliver that”
“WUFFS only works for very simple codecs.”
“really this kind of problem screams out for the approach taken in WUFFS”
“you'll see benchmarks very favorably comparing to rust implementations”
“Wuffs programs take longer for a programmer to write, as they have to explicitly annotate their programs with proofs of safety”
“It has compile-time spatial memory safety, where Rust has compile-time temporal safety but runtime spatial safety”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.