PHP Serialize / Unserialize

Convert PHP objects and arrays into serialized strings and back

PHP Tool

Action

Result

Read PHP serialized data without running PHP

Serialized strings like a:2:{s:6:"status";s:7:"success";s:4:"code";i:200;} turn up in WordPress options tables, session files, cache entries and old exports. They are compact for PHP but painful for people. This page turns a simple serialized value into indented JSON so you can see what is inside without writing a script.

Viewing a serialized string

Paste the string into the Input Data box. Load Sample inserts a small array and Clear empties the field.
Leave the Action dropdown on Unserialize (to JSON/Readable).
Click Execute Transformation.
Read the Result panel and use Copy to take the text away.

What it can handle

The converter uses text replacement rather than PHP's real unserialize logic. It rewrites strings, integers, decimals and booleans, swaps the array header for braces and tries to parse the outcome as JSON. Flat or lightly nested arrays that follow the usual pattern generally convert well. If the result cannot be parsed as JSON, the tool falls back to a rough cleaned-up display of the string so you can still eyeball the values.

Limitations you should be aware of

The Serialize (from JSON/Object) option is listed, but it does not produce serialized output. Selecting it shows a message saying the feature needs specialised PHP logic.
Keys are not read as key and value pairs, so array keys can be lost or misplaced in the JSON, and numeric-indexed arrays do not always come out as clean lists.
Strings that contain double quotes, objects with class names (O:...), nested structures with many levels and null values are not reliably handled.

Treat the result as a reading aid, and confirm anything important using PHP's own unserialize() or a WordPress-aware tool. Never unserialize untrusted input inside a PHP application, because doing so can trigger object injection vulnerabilities.

Everyday situations

Peeking at a value from a WordPress options or postmeta column.
Understanding what an old session or cache file stored.
Checking the length fields in a hand-edited serialized string.
Explaining the serialization format to a teammate with a real example.

Everything is processed by JavaScript in your browser when you click the button, and typing in the box clears the previous output.

Related Tools

Frequently Asked Questions

Can this tool serialize data too?

Not at the moment. The Serialize option is present in the dropdown, but choosing it only displays a message that serialization needs specialised PHP logic. Use PHP's serialize() function to create serialized strings.

How accurate is the unserialize view?

It is a text-based approximation. Simple arrays with strings, integers and booleans usually convert, but keys, objects, null values and deeply nested structures may come out wrong. Check important data with PHP's unserialize().

What happens when the conversion fails?

If the transformed text is not valid JSON, the tool shows a simplified version of your input with the quoting and array headers cleaned up. It is meant to help you read the values, not to produce valid JSON.

Does it support serialized objects?

Not reliably. Object entries that start with O: and include class names and property visibility markers are outside what the simple converter understands. Expect an unclear result for those and inspect them with PHP instead.

Is it safe to unserialize strings from unknown sources?

Viewing them here is harmless because nothing is executed. In PHP applications, however, calling unserialize() on untrusted input can lead to object injection. Prefer JSON for external data, or restrict allowed classes.