# PHP Serialized Object Decoder

> Read PHP serialize() output as a structured value: arrays, strings, numbers and objects.

- Page: https://decoder.tools/php-serialize-decoder
- Category: Web, API & Tokens
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A PHP serialize decoder parses the text produced by PHP's `serialize()`, such as `a:1:{s:4:"name";s:3:"Ada";}`, into the array, string, number or object it describes, without running any PHP.

## Example

```text Input
a:2:{s:4:"name";s:3:"Ada";s:5:"roles";a:1:{i:0;s:5:"admin";}}
```

```text Output
array(2) {
  ["name"] => string(3) "Ada"
  ["roles"] => array(1) {
    [0] => string(5) "admin"
  }
}
```

Protected and private object properties are labelled, and the string lengths are shown so you can spot a length that no longer matches its content.

## The serialize() format

Each value starts with a one-letter type code:

| Code | Type | Example |
|---|---|---|
| `s` | string (length in bytes) | `s:3:"Ada";` |
| `i` | integer | `i:42;` |
| `d` | float | `d:3.14;` |
| `b` | boolean | `b:1;` |
| `N` | null | `N;` |
| `a` | array (element count, then key/value pairs) | `a:1:{i:0;s:1:"x";}` |
| `O` | object (class name, property count) | `O:4:"User":1:{s:2:"id";i:7;}` |

String lengths count **bytes**, not characters, so `s:2:"é";` is correct in UTF-8. Hand-editing a serialized string without fixing the lengths is the most common cause of "unserialize(): Error at offset" errors.

Private and protected object properties have their names prefixed with null bytes (`\0User\0name`), so they look odd when printed.

## How to use the PHP serialize decoder

1. Paste the `serialize()` output — a WordPress option, a session value or a cache entry.
2. Read the structure, with array keys, object classes and value types spelled out.
3. An "Error at offset" means a string length no longer matches its content, usually from hand-editing or a re-encode.

The parser never calls `unserialize()`, so no objects are created and no magic methods run — it is safe on untrusted data. You'll find serialized PHP in WordPress `wp_options` and post meta, in session files (`sess_*`) and in cache entries.

## Security notes

Never call `unserialize()` on data a user can control. Creating objects can trigger "magic methods" such as `__wakeup()` and `__destruct()`, which attackers chain into **PHP object injection** and sometimes remote code execution. Use `json_decode()` for untrusted data, or pass `["allowed_classes" => false]`.

## PHP serialize at a glance

| | |
|---|---|
| Produced by | `serialize()` in PHP |
| Read by | `unserialize()` |
| String lengths | In bytes |
| Main risk | Object injection through `unserialize()` on user input |

## FAQ

### Why does unserialize() fail with "Error at offset"?

A string length doesn't match its content, usually because the data was edited by hand, re-encoded (for example Latin-1 to UTF-8) or truncated. Recompute the `s:N:` length for each changed string.

### How is WordPress data serialized?

WordPress stores arrays in `wp_options` and post meta with `serialize()`. Search-and-replace tools for domain migrations must update the string lengths too, which is why plain SQL `REPLACE()` breaks serialized options.

### Should I use serialize() or json_encode()?

Use JSON for anything that crosses a trust boundary or another language. `serialize()` is PHP-only and unsafe to read from untrusted sources.