Serialize & Unserialize
Convert PHP serialized data to readable JSON, and JSON back to PHP serialize format.
Continue your work
- JSON Formatter & Validator — Format and validate the JSON output.
- JSON Tree Viewer — Explore large unserialized data as a tree.
Rate this tool
0.0
0 ratings
- 5 stars 0
- 4 stars 0
- 3 stars 0
- 2 stars 0
- 1 star 0
Share this tool
Found it useful? Send it to a friend or teammate.
Report an issue
Something broken or not quite right? Tell us and we will look into it.
Clear instructions
Find steps, examples and limitations below.
Use online
Open the tool in a supported web browser.
Free to use
No sign-up required. Tool-specific limits may apply.
How to use the Serialize & Unserialize
PHP's serialize() format stores arrays and objects as strings, and you often find it in WordPress options, sessions and cache tables. This tool converts serialized data into readable, formatted JSON and converts JSON back into PHP serialize format. It counts string lengths in UTF-8 bytes exactly like PHP, and pinpoints where a corrupted string breaks, the usual cause of "unserialize(): Error at offset".
- 1 Choose Unserialize to read PHP data, or Serialize to create it from JSON.
- 2 Paste your data, or load the example.
- 3 Copy the result. Use Swap to convert it back the other way.
Example and practical tips
a:2:{s:4:"name";s:5:"Ayesha";…} will not unserialize because "Ayesha" is 6 bytes, not 5. The tool reports the byte where the mismatch occurs so you can fix the length.
Frequently asked questions
Why does unserialize() fail after a search-and-replace?
Serialized strings store their length. Replacing text changes the length without updating it, which breaks the data. Use a serialization-aware search-and-replace tool.
How are PHP objects shown?
Objects become JSON objects with a "__class" key holding the class name. Private and protected property prefixes are removed for readability.
Is it safe to unserialize untrusted data?
This tool only parses text and never runs code, so it is safe to use here. In PHP, never call unserialize() on untrusted input; use JSON instead.