PHP Unserialize
Runs in your browserPaste a serialized string from a database, a cache or wp_options and read it as JSON, with private properties, enums and references spelled out.
Serialized PHP
JSON
111 B
How this one works
Paste a serialized string on the left and it’s decoded as you type. Arrays whose keys run 0, 1, 2… in order become JSON arrays, the same rule json_encode uses; any other array becomes an object with its keys in their original order. Objects get a "__class" key first, and private and protected properties show as "token (private)" or "role (protected)".
If a database search-replace changed the text inside the data but not the s:N lengths in front of it, press Fix broken string. It recounts each length in bytes, tries each possible end when a string itself contains ";, and only gives you a result that unserializes cleanly.
Switch the output to PHP (var_export) to see it the way var_export() prints it. Large inputs are decoded in a background thread so the page stays responsive.
Questions
Why does unserialize fail after a search-replace?
Serialized strings store each string’s length in bytes, like s:20:"http://old-site.test". A plain find-and-replace in the database changes the text but not the number, so PHP reads the wrong number of bytes and unserialize() returns false. WordPress options, widgets and post meta break this way after a domain change. Fix broken string recounts every length.
What is the difference between serialize and json_encode?
serialize() keeps PHP-only detail: integer versus float, objects and their class names, private and protected properties, enums and references. json_encode() is portable but loses most of that. That is why this tool marks classes with "__class" and visibility in the key names.
How are very large integers and INF or NAN shown?
Integers are written with every digit, even past what JavaScript can hold; tick "Big integers as strings" if a JavaScript program will read the result. INF, -INF and NAN aren’t valid JSON, so they are shown as strings with a note.
Is it safe to unserialize data I don’t trust?
Here, yes: this only reads the text and never creates PHP objects, so there is nothing to exploit. In PHP itself, never call unserialize() on untrusted input without allowed_classes set to false, because it can trigger object injection.
Is my data sent anywhere?
No. The parser is JavaScript running in this tab, and large inputs go to a worker thread in the same tab, not to a server. Nothing you paste is uploaded or stored.