Why does my serialized string fail to parse?

Almost always a length mismatch: s:5 must be followed by exactly 5 bytes. Editing the text by hand, or a character-set change from a database migration, breaks the byte counts and invalidates the payload.

Is serialize() the same as JSON?

No. PHP serialization preserves object classes and private property names, which JSON cannot. That extra power is precisely what makes unserialize() dangerous on untrusted input — json_decode() has no such behaviour.

What does O:8:"stdClass" mean?

An object whose class name is 8 characters long: stdClass. The number after the class name is the count of properties that follow.

PHP Serialized Object Decoder

Parse PHP serialize() output into a readable, structured view.

on the roadmapWeb, API & Tokensfree · no sign-up

This bench is being wired up

The php-serialize-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the PHP Serialized Object Decoder?

A PHP serialize decoder parses the output of PHP's serialize() function — a compact type-tagged text format such as a:2:{i:0;s:5:"hello";} — into a readable tree of arrays, objects and scalar values.

PHP's serialization format encodes every value with a type letter, a length and the data: s:5:"hello" is a 5-character string, i:42 an integer, b:1 a boolean, a:2:{...} a two-element array, and O:8:"ClassName":2:{...} an object with two properties. Private properties get null-byte-wrapped names, which is why raw serialized data often looks corrupted when pasted into a plain text field.

You meet this format in session files, WordPress wp_options rows, Laravel cache entries and legacy cookie payloads. It is also a major security topic: passing attacker-controlled data to unserialize() lets an attacker instantiate arbitrary classes and trigger magic methods like __wakeup or __destruct — the PHP object injection class of vulnerability.

PHP Serialized Object Decoder at a glance

String: s:LENGTH:"value" — byte length, not characters
Array / object: a:N:{...} · O:LEN:"Class":N:{...}
Scalars: i:int · d:float · b:0|1 · N; for null
Risk: unserialize() on untrusted input = object injection

How to use the PHP Serialized Object Decoder

1Copy the serialized string from the database column, session file or cookie.
2Paste it in to see the parsed structure with types and nesting.
3Check the declared string lengths if parsing fails — a truncated value breaks the whole payload.

When you would reach for it

Reading a WordPress option or post meta value stored as a serialized array.
Inspecting a PHP session file during application debugging.
Analysing a suspicious payload in a PHP object injection assessment.

PHP Serialized Object Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools