A PHP serialize decoder parses the text produced by PHP's serialize(), such as a:1:{s:4:"name";s:3:"Ada";}, into the array, string, number or object it describes, without running any PHP.
Example
a:2:{s:4:"name";s:3:"Ada";s:5:"roles";a:1:{i:0;s:5:"admin";}}array(2) {
["name"] => string(3) "Ada"
["roles"] => array(1) {
[0] => string(5) "admin"
}
}Protected and private object properties are labelled, and the string lengths are shown so you can spot a length that no longer matches its content.
The serialize() format
Each value starts with a one-letter type code:
| Code | Type | Example |
|---|---|---|
s | string (length in bytes) | s:3:"Ada"; |
i | integer | i:42; |
d | float | d:3.14; |
b | boolean | b:1; |
N | null | N; |
a | array (element count, then key/value pairs) | a:1:{i:0;s:1:"x";} |
O | object (class name, property count) | O:4:"User":1:{s:2:"id";i:7;} |
String lengths count bytes, not characters, so s:2:"é"; is correct in UTF-8. Hand-editing a serialized string without fixing the lengths is the most common cause of "unserialize(): Error at offset" errors.
Private and protected object properties have their names prefixed with null bytes (\0User\0name), so they look odd when printed.
How to use the PHP serialize decoder
- Paste the
serialize()output — a WordPress option, a session value or a cache entry. - Read the structure, with array keys, object classes and value types spelled out.
- An "Error at offset" means a string length no longer matches its content, usually from hand-editing or a re-encode.
The parser never calls unserialize(), so no objects are created and no magic methods run — it is safe on untrusted data. You'll find serialized PHP in WordPress wp_options and post meta, in session files (sess_*) and in cache entries.
Security notes
Never call unserialize() on data a user can control. Creating objects can trigger "magic methods" such as __wakeup() and __destruct(), which attackers chain into PHP object injection and sometimes remote code execution. Use json_decode() for untrusted data, or pass ["allowed_classes" => false].
PHP serialize at a glance
| Produced by | serialize() in PHP |
| Read by | unserialize() |
| String lengths | In bytes |
| Main risk | Object injection through unserialize() on user input |
Frequently asked questions
Why does unserialize() fail with "Error at offset"?
A string length doesn't match its content, usually because the data was edited by hand, re-encoded (for example Latin-1 to UTF-8) or truncated. Recompute the s:N: length for each changed string.
How is WordPress data serialized?
WordPress stores arrays in wp_options and post meta with serialize(). Search-and-replace tools for domain migrations must update the string lengths too, which is why plain SQL REPLACE() breaks serialized options.
Should I use serialize() or json_encode()?
Use JSON for anything that crosses a trust boundary or another language. serialize() is PHP-only and unsafe to read from untrusted sources.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown