PHP Unserialize / Serialize Online
Unserialize PHP data to JSON, print_r, var_export or var_dump, serialize JSON back, and repair broken s:N string lengths after a search-and-replace.
PHP stores arrays and objects in databases with serialize() — WordPress options and post meta, sessions, cache entries — in a format like a:1:{s:3:"key";s:5:"value";}. This tool reads that format without running PHP and shows the data as JSON or exactly as print_r(), var_export() or var_dump() would print it. It also serializes JSON back into PHP format and can repair the s:N string lengths that break after a database search-and-replace.
How to use this tool
- Paste the serialized string, for example from a WordPress option.
- Choose how to show it: JSON, print_r, var_export or var_dump.
- If PHP reports "Error at offset" because text was replaced, tick "Repair wrong string lengths", check the views, and copy the repaired data (it is a best guess).
- To go the other way, choose Serialize JSON and paste JSON.
Formula
N; null · b:1; bool · i:42; int · d:0.5; float · s:5:"hello"; string (length in bytes) · a:2:{…} array · O:8:"stdClass":1:{…} object · r:2; reference
String lengths are UTF-8 byte counts, so "é" is s:2 and an emoji s:4 — the usual reason data breaks when a URL or text is replaced directly in the database. Repair is a best guess: for each broken string it takes the first "; that is followed by a valid next item as the end and rewrites the length, so a string that itself contains such text would be cut too early — always check the result. Private and protected properties are decoded from their \0Class\0name form. References (r: and R:) are followed; a reference to a containing value is shown as *RECURSION*. Floats are printed as PHP 8 does: 14 significant digits in print_r, the shortest exact form elsewhere.
Example
The sample a:4:{…} holds four values: name "Ada Lovelace" (s:12), age 36, langs — an inner array of "PHP" and "Python" — and active true; counting the array itself and the two strings inside the list, that is 7 values. As JSON it reads {"name": "Ada Lovelace", "age": 36, "langs": ["PHP", "Python"], "active": true}. After replacing http:// with https:// in a database, s:18:"https://example.com" is one byte short; repair rewrites it as s:19.
Frequently asked questions
Why does WordPress data break after a search and replace?
Each string stores its byte length. Replacing http:// with https:// adds a byte, so the length no longer matches and unserialize() fails. Use a serialization-aware tool such as WP-CLI search-replace. Repairing the lengths here is a best guess for data that is already broken: check the result and keep a backup.
Is it safe to unserialize untrusted data?
In PHP, unserialize() on untrusted input can create objects and trigger code (object injection). This tool only reads the text and never runs any class code, so pasting data here is safe.
Why are objects shown with "__class"?
JSON has no classes, so the class name is kept in an extra "__class" key. print_r, var_export and var_dump show the class the way PHP does.
Is my data uploaded?
No. Everything runs in your browser.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/php-unserialize-tool/
Cite or embed this tool
kakaoCalc. (2026, November 8). PHP Unserialize / Serialize Online. https://kakao.mobile/tools/php-unserialize-tool/
“PHP Unserialize / Serialize Online.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/php-unserialize-tool/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms