Online php serialize / unserialize: turns a PHP array into a serialized string and, the other way round, parses such a string into a readable form. Handy when you need to inspect or fix data that a PHP application (WordPress, Bitrix, sessions, cache) stored in the database.
What serialize is
The serialize() function writes a PHP value of any nesting into a string, and unserialize() restores it. Every value starts with a type letter, and string lengths are given in bytes.
Type letters
| Letter | Type | Example |
|---|---|---|
| N | null | N; |
| b | boolean | b:1; |
| i | integer | i:30; |
| d | float | d:1.5; |
| s | string | s:5:"hello"; |
| a | array | a:1:{i:0;s:1:"a";} |
| O | object | O:4:"User":1:{s:4:"name";s:3:"Bob";} |
Example
The array ['name' => 'Привет', 'age' => 30, 'admin' => true, 'x' => null, 'k' => 1.5] becomes:
a:5:{s:4:"name";s:12:"Привет";s:3:"age";i:30;s:5:"admin";b:1;s:1:"x";N;s:1:"k";d:1.5;}
Note s:12 for the word "Привет": 6 letters but 12 bytes in UTF-8.
Good to know
- Length in bytes. If you edit text in the string by hand without fixing the length, unserialize returns false. A common problem when search-and-replacing a domain in a WordPress database dump.
- Changing the encoding (cp1251 → UTF-8) breaks serialized strings for the same reason.
- Security. Never call
unserialize()on user input: a string withO:creates an object of any class, and its magic methods (__wakeup,__destruct) may run attacker code — the PHP Object Injection vulnerability. If you must, useunserialize($s, ['allowed_classes' => false]).
JSON as an alternative
For data exchange and storage json_encode() / json_decode() is usually better: any language reads it, it does not create objects and does not depend on byte lengths. serialize is needed when you must keep PHP objects and the int/float/null distinction.
How to use the page
- Serialize — enter an array in PHP syntax, e.g.
[1 => 'a', 'key' => 'value'], and get the string. - Unserialize — paste a serialized string and see its structure.