PHP Unserialize

PHP Unserialize is a free online tool for decoding and visualizing PHP serialized strings. PHP serialization converts complex data structures like arrays and objects into a storable string format, and this tool reverses that process to show you the original data structure.

Our tool supports multiple input formats including PHP serialized strings, JSON data, and Base64-encoded content. The interactive tree view makes it easy to explore nested data structures of any complexity.

Whether you're debugging WordPress options, analyzing session data, or working with cached data, our tool provides instant visualization with multiple output formats. All processing happens in your browser, ensuring your data remains private.

PHP's serialization format encodes a length with every string, and that is where the errors come from. If a serialized value has been edited by hand, truncated by a database column that was too small, or passed through a character-set conversion that changed the byte length of a multibyte string, the declared length no longer matches the content and the whole structure fails to parse. The message usually names the offset, which is the place to look. Object properties carry visibility in a way that is easy to miss: a private property is stored with the class name wrapped in null bytes around it, and a protected one with an asterisk, so keys can look corrupted when they are correct. Unserializing untrusted input in PHP is a known remote code execution risk, because it can instantiate objects and trigger magic methods. Decoding it here is safe because nothing is executed.