Paste a string produced by PHP's serialize(), such as a WordPress option, a session or a cache value, and read it as JSON, a collapsible tree, print_r() or var_export() output. Broken string lengths after a database search-and-replace are repaired automatically, and a second tab turns JSON back into PHP serialized format.
Last updated:
Result
Decoding happens in your browser with a safe parser: no PHP code runs, no objects are instantiated, and nothing is uploaded.
Advertisement
Advertisement
How to use the PHP Unserialize Online
Paste the serialized string into the left box or open a text file. A sample WordPress-style option is loaded to start with.
Pick a view: JSON, Tree, print_r() or var_export(). With Live update on, the result refreshes as you type.
Fix broken data: keep Repair wrong string lengths on, then press Copy repaired string to get a valid value to save back.
Copy or download the decoded result.
Going the other way? Open the Serialize tab, paste JSON and copy the PHP serialized string.
PHP serialize() format reference
Every value starts with a one-letter type marker. Lengths and counts are written before the data, and string lengths are measured in bytes.
Marker
PHP type
Example
Meaning
N
null
N;
NULL value
b
bool
b:1;
true (1) or false (0)
i
int
i:-42;
Integer
d
float
d:0.1;d:INF;
Floating point, also INF, -INF and NAN
s
string
s:5:"Café";
Byte length, then the raw bytes in quotes
a
array
a:2:{i:0;s:1:"x";s:1:"k";b:1;}
Element count, then key/value pairs
O
object
O:8:"stdClass":1:{s:2:"id";i:7;}
Class name length, class name, property count, properties
C
Serializable object
C:3:"Foo":4:{data}
Custom payload from a class implementing Serializable
E
enum (PHP 8.1+)
E:11:"Suit:Hearts";
Enum class and case name
r / R
reference
R:2;
Points back to the n-th value written (1-based)
Private properties are stored as \0ClassName\0prop and protected ones as \0*\0prop, where \0 is a NUL byte. That is why the declared length of a private property name is longer than the visible name, and why copying such data through some editors that drop NUL bytes breaks it.
Fixing broken serialized data
Search-and-replace damage: replacing http://old.test with https://www.new-site.com directly in SQL changes the string but not its s:N: prefix, so PHP's unserialize() returns false. Paste the value here, keep the repair option on and copy the repaired string. For whole databases, use a serialization-aware search-and-replace tool instead of plain SQL.
Encoding changes: converting a table from Latin-1 to UTF-8 changes byte counts of accented letters; the repair recalculates them in UTF-8.
Escaped quotes: data copied from PHP source or a SQL dump may contain \" instead of ". Unescape it first (for example with find and replace) before decoding.
Prefer JSON for new code:json_encode() is portable, readable in any language and safe to decode. Keep serialize() for data that already uses it.
Frequently asked questions
What does PHP unserialize do?
unserialize() turns the text produced by serialize() back into a PHP value. The format stores the type and size of every value, for example s:5:"hello"; is a 5-byte string and a:2:{...} is an array with two elements. This tool reads the same format and shows it as JSON or a tree without running PHP.
Why does my serialized string fail with an offset error in PHP?
Usually because a string's declared byte length no longer matches its content. This happens after a plain search-and-replace in a database (for example changing a domain name in WordPress) or when a multibyte character was counted as one byte. Keep Repair wrong string lengths on and copy the repaired string.
Are string lengths counted in characters or bytes?
In bytes of the stored encoding, normally UTF-8. "Café" is s:5 because é takes two bytes, and most emoji take four. The tool counts UTF-8 bytes in both directions.
Is it safe to unserialize untrusted data?
In PHP, calling unserialize() on user input is risky because it can create objects and trigger magic methods such as __wakeup or __destruct (object injection). This tool never runs PHP or creates objects, so inspecting data here is safe. In your own code prefer json_decode, or pass ['allowed_classes' => false] to unserialize.
How are PHP objects shown in JSON?
Object properties become JSON keys, and with Keep class names on a "__class" key holds the class name. Private and protected property names, which PHP stores with hidden NUL-byte prefixes, are cleaned up; the Tree and print_r views show their visibility.
Why did a float become an integer when serializing JSON?
JSON has a single number type, so 1.0 and 1 are identical after parsing. Whole numbers become PHP integers (i:), while numbers with a fractional part or exponent become floats (d:).
What are r: and R: in serialized data?
They are back-references to a value that appeared earlier, counted from 1 in the order values were written. R: is a PHP reference (&$var) and r: is a repeated object handle. The tool resolves them and marks circular ones as *RECURSION*.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.