Paste a PHP serialized string, e.g.
a:2:{s:3:"foo";i:1;s:3:"bar";b:1;}
Ready to convert
Paste input and click Convert// serialize & unserialize php data in one click
Serialize PHP arrays and objects to strings, or unserialize PHP serialized data back to readable format. Browser-based, free, no sign-up required.
a:2:{s:3:"foo";i:1;s:3:"bar";b:1;}
Ready to convert
Paste input and click ConvertSelect Unserialize to decode a serialized PHP string, or Serialize to convert JSON/array data into a PHP serialized string.
Paste the serialized string or valid JSON into the input box. Use the sample buttons to try examples instantly.
Hit Convert and see the result immediately. Copy the output with one click.
PHP's serialize() converts arrays and objects into a compact, storable string representation. This tool lets you convert data in both directions — serialize JSON into a PHP string, or decode a serialized string back into a human-readable structure — all in your browser.
PHP's serialize() function converts a PHP value — array, object, string, int, bool, or null — into a storable string representation. The result can be saved in a database, file, or session and later restored with unserialize().
A serialized string has a compact format: a: for arrays, s: for strings, i: for integers, b: for booleans, O: for objects, and N; for null. This tool automatically decodes it into a human-readable structure.
You can serialize arrays, objects, strings, integers, floats, booleans, and null. Resources (like database connections or file handles) cannot be serialized.
Unserializing untrusted data is a known PHP security risk. PHP can instantiate arbitrary classes during unserialization, which may trigger dangerous code. Always validate and whitelist allowed classes in production code. This tool runs the process server-side in a sandboxed context.
The Serialize mode expects valid JSON as input — arrays, objects, strings, numbers, booleans, or null. This JSON is decoded and then passed through PHP's serialize() to produce the serialized string output.
WordPress stores many settings, plugin configurations, and post meta as serialized PHP strings in the wp_options and wp_postmeta database tables. Being able to read and edit these values is essential for debugging and migrations.
Yes — the conversion is performed server-side via a PHP API endpoint because PHP serialization is a PHP-native feature. However, no data is stored, logged, or retained after the request completes.
It means the string doesn't follow the PHP serialization format — perhaps it was truncated, corrupted, or is not actually a serialized value. Try checking the string length byte counts (e.g. s:3:"foo" requires exactly 3 characters between the quotes).
PHP serialization is a foundational mechanism in the PHP ecosystem. Whether you're debugging a WordPress database, building a caching layer, or reverse-engineering a legacy application, understanding serialized PHP data is an everyday developer task. This free online PHP Serializer/Unserializer lets you instantly convert in both directions — no setup, no installation, no sign-up required.
PHP serialization is the process of converting a PHP value into a flat string that can be stored or transmitted and later reconstructed. The serialize() function was introduced very early in PHP's history and remains in widespread use today, particularly in:
PHP serialized strings follow a compact, type-annotated format. Each value is prefixed with a type code and length indicator:
i:42; — integer 42d:3.14; — float 3.14b:1; — boolean true (b:0; for false)N; — nulls:5:"hello"; — string "hello" (5 characters)a:2:{s:3:"foo";i:1;s:3:"bar";b:1;} — array with 2 elementsO:8:"stdClass":1:{s:4:"name";s:5:"Alice";} — object of class stdClassOne subtle aspect of the format is that string lengths are byte counts, not character counts. For multibyte strings (e.g. UTF-8 encoded Chinese or Arabic text), the byte count will differ from the visible character count. This is a common source of corruption when serialized strings are manually edited.
Unserialization takes a PHP serialized string and reconstructs the original value. In PHP code this is simply unserialize($str). This tool performs the same operation server-side and displays the result in a pretty-printed, human-readable format. Arrays are shown with their key-value pairs, objects with their class name and properties, and primitives as their literal values.
Common scenarios where you'll need to unserialize:
wp_options rows in a WordPress database dumpThe Serialize mode accepts JSON as input. JSON is the natural interchange format for structured data, and this tool converts it to a PHP serialized string using the same rules as PHP's native serialize() function. This is useful when you need to insert serialized data directly into a database, generate test fixtures for PHP unit tests, or prepare data for a PHP application from a non-PHP environment.
Both serialization and JSON are common ways to store structured data as a string, but they serve different purposes:
Modern PHP applications increasingly prefer JSON (via json_encode()/json_decode()) for new data storage, while serialization appears most commonly in legacy code and systems like WordPress.
PHP unserialization of untrusted data is a well-documented attack vector. When PHP unserializes an object, it may instantiate PHP classes present in the codebase and trigger magic methods like __wakeup() or __destruct(). This can lead to Remote Code Execution (RCE) in some configurations — a class of vulnerability known as PHP Object Injection.
Best practices when working with serialized data in production:
allowed_classes option in unserialize() to whitelist safe classesWordPress is one of the most common reasons developers encounter PHP serialized strings. WordPress stores a wide variety of data as serialized strings in the wp_options table — widget settings, theme mods, plugin configurations, and more. When performing database migrations, search-and-replace operations, or debugging plugin issues, being able to decode these strings is essential.
A critical warning for WordPress developers: never do a plain text search-and-replace on serialized data in the database. Because serialized strings contain byte-length prefixes, changing the URL or domain embedded in a serialized string requires recalculating all affected lengths. Use proper tools like WP-CLI's search-replace command, which handles serialized data automatically.
This PHP Serializer/Unserializer is part of JLV DevTools, a free collection of browser-based utilities for developers. The conversion runs server-side via PHP for accuracy, but no data is stored or logged. The tool supports all standard PHP serializable types: scalars (int, float, string, bool, null), arrays, and objects.