Programming Language Tools

PHP Serialized Data Decoder

Safely decode PHP's serialize() string format into readable structured data - never executes or unserializes actual PHP objects.

Paste a PHP serialize() string below - this tool parses its structure and displays the decoded values, entirely as safe text parsing.

This parses the serialize() string format as plain text only - it never calls PHP's actual unserialize() function or instantiates any object, which is important since unserializing untrusted data is a well-known PHP security risk.

PHP Serialized String

More Programming Language Tools

View all 23

PHP var_dump Formatter Python Formatter JSON to PHP Array Python JSON Formatter PHP Array to JSON Python Requirements Generator PHP Formatter Python Package Name Checker

This is a text parser, not PHP's actual unserialize() function - it never executes or instantiates PHP objects, which is important since unserializing untrusted data is a well-known PHP security risk.

What Is PHP's Serialize Format?

PHP's serialize() function converts a value into a specially-formatted string encoding its type and structure (e.g. a:2:{s:3:"key";s:5:"value";} for an array) - commonly seen in database session data, cached values, or legacy data exports.

Why Use This Tool?

Serialized strings are hard to read by eye. Rather than running PHP's actual unserialize() (which executes object constructors and is a documented security risk for untrusted input), this tool safely parses the string format as plain text.

How to Use It

Paste a PHP serialized data string.
Click Decode.
Review the structured, readable breakdown.

Important Notes

This tool parses the serialized format as text only - it never calls PHP's actual unserialize() function or instantiates any object, which is precisely the security risk this approach avoids when handling untrusted serialized data.

Frequently Asked Questions

Yes. The string is parsed as text and PHP's unserialize() is never called, so no objects are created or code triggered.

Often from database columns, session files, caches and WordPress options - strings like a:2:{s:3:"key";s:5:"value";}.

Each string stores its byte length (s:5:). Editing a value by hand without updating the length corrupts the data - a common problem after search-and-replace in databases.