Advertisement
Advertisement

Free online PHP unserialize and serialize tool — decode serialized PHP data to readable JSON, convert it back, and repair blobs broken by search-and-replace.

Advertisement
Advertisement

About PHP serialization

Paste a serialized PHP string — the kind stored in WordPress wp_options, Laravel sessions, or a cache table — and click Unserialize to read it as formatted JSON. Click Serialize to turn JSON back into PHP's format, or Fix lengths to fix a blob whose string lengths no longer match its contents. Everything runs locally in your browser, so credentials and customer data in a database dump never leave your machine.

Is my data uploaded anywhere?

No. Parsing, serializing, and repairing all happen in your browser with JavaScript — the serialized data is never sent to a server, so the tool works offline and is safe for production database dumps.

Why does my serialized string fail to unserialize?

Almost always because the s: length prefixes no longer match the strings. PHP records each string's length in bytess:5:"Alice" — and if a search-and-replace changes the contents without updating the number, PHP refuses the entire value and returns false. Click Fix lengths to recompute every prefix from the actual content.

How do I fix WordPress serialized data after changing the site URL?

Running a plain SQL REPLACE() over wp_options or wp_postmeta breaks every serialized value that contained the old URL, because the stored lengths still describe the old text. Paste the broken value here and use Fix lengths — it rewrites the byte counts so PHP accepts the row again, leaving the rest of the structure untouched.

Why is the length different from the number of characters?

Lengths are counted in bytes, not characters. In UTF-8 an accented letter such as é takes two bytes and an emoji takes four, so "héllo" is five characters but s:6:. This tool counts bytes exactly the way PHP does, so multibyte content round-trips correctly.

What happens to objects, references, and floats?

Objects keep their class name, shown as "__php": "object" with a class field. Back-references (R: and r:) are resolved to the value they point at. INF, NAN, and integers too large for JSON are tagged rather than silently turned into null or rounded, so nothing is lost without you noticing.

Does it preserve the order of array keys?

Yes. PHP arrays are ordered maps, but JavaScript objects list integer-like keys first, so a naive converter would turn {name, 0} into {0, name}. This tool records the original order and honours it both in the JSON view and when serializing back.

Collapse the page

Both options play the collapse and reload this site fresh from the network. They differ in what they take with them.

Refresh files
Drops the offline cache and service worker. Your saved inputs and settings are kept — use this if the site is serving something stale.
Erase everything
All of the above, plus every tool's saved input — including your JWT and HMAC keys — and your settings. Deleted from your device, not sent anywhere. This cannot be undone.