PHP Serialized Data Decoder
Safely decode PHP's serialize() string format into readable structured data - never executes or unserializes actual PHP objects.
Paste a PHP serialize() string below - this tool parses its structure and displays the decoded values, entirely as safe text parsing.
This parses the serialize() string format as plain text only - it never calls PHP's actual unserialize() function or instantiates any object, which is important since unserializing untrusted data is a well-known PHP security risk.
This is a text parser, not PHP's actual unserialize() function - it never executes or instantiates PHP objects, which is important since unserializing untrusted data is a well-known PHP security risk.
What Is PHP's Serialize Format?
PHP's serialize() function converts a value into a specially-formatted string encoding its type and structure (e.g. a:2:{s:3:"key";s:5:"value";} for an array) - commonly seen in database session data, cached values, or legacy data exports.
Why Use This Tool?
Serialized strings are hard to read by eye. Rather than running PHP's actual unserialize() (which executes object constructors and is a documented security risk for untrusted input), this tool safely parses the string format as plain text.
How to Use It
- Paste a PHP serialized data string.
- Click Decode.
- Review the structured, readable breakdown.
Important Notes
This tool parses the serialized format as text only - it never calls PHP's actual unserialize() function or instantiates any object, which is precisely the security risk this approach avoids when handling untrusted serialized data.