PHP Unserializer & Serializer
Convert PHP serialize() strings (s, i, d, b, N, a, O, r/R) into JSON with UTF-8 byte-length accuracy, or serialize JSON back into PHP format.
Private by architecture:
All processing is 100% client-side memory. Your data never leaves this browser tab.
PHP serialized input
0 lines · 0 charsPHP
JSON output
0 lines · 0 chars
About This Tool
Parses PHP serialize() payloads (s, i, d, b, N, a, O, r, R) into clean JSON and converts JSON back into valid PHP serialize() strings -- without executing any PHP code.
Uses a UTF-8 byte-stream parser so multi-byte characters (such as accented letters, CJK text, or currency symbols) match PHP strlen() byte counts accurately, and syntax errors report their exact byte offset.
Key Features
- UTF-8 byte-aware string lengths: Measures string and class-name lengths in UTF-8 bytes via TextEncoder/TextDecoder, matching PHP strlen() behavior on multi-byte characters.
- Objects & visibility cleanup: Parses O: serialized objects into {"__phpClass": "..."} and strips null-byte prefixes from protected (\0*\0) and private (\0Class\0) properties.
- Safe reference inspection: Reports internal r: and R: pointer references explicitly without executing __wakeup() or gadget chains.
- Bidirectional JSON to PHP serialize(): Switch direction to convert any JSON object or array into a valid PHP serialize() string with recalculated UTF-8 byte counts.
Frequently Asked Questions
Why is unserializing untrusted data in PHP dangerous, and why is this tool safe?
Calling PHP unserialize() on untrusted input can instantiate arbitrary classes and trigger magic methods (__wakeup, __destruct), leading to PHP Object Injection vulnerabilities. This tool is a pure TypeScript parser running in your browser: it never instantiates PHP classes or executes code.
Why did my hand-edited PHP serialized string fail with a byte length mismatch?
In PHP, s:N:"..." specifies N in bytes, not characters. A UTF-8 character like € is 3 bytes (so "€49" is s:5:"€49";). You can convert your edited JSON back via the "JSON to PHP serialize()" mode to recalculate exact byte counts automatically.
How are sequential vs associative PHP arrays represented in JSON?
A PHP array whose keys are sequential integers 0, 1, ..., n-1 becomes a JSON array [...]. Any PHP array with string keys or non-sequential integer keys becomes a JSON object {...}.
