How to convert PHP serialized data to JSON
Paste a serialized string produced by PHP's serialize() function into the converter above, click Unserialize, then review or copy the readable JSON result. You see the decoded structure without running PHP yourself.
- Copy the complete serialized value, including its type markers, lengths, and delimiters.
- Paste it into the editor and click Unserialize.
- Use the JSON result to inspect the structure without editing the original value by hand.
Convert it in your own PHP code
Call unserialize() with allowed_classes set to false, then pass the result to json_encode(). unserialize() returns false when the value is invalid.
$value = unserialize($serialized, ['allowed_classes' => false]); echo json_encode($value, JSON_PRETTY_PRINT);
Need the PHP array instead of JSON? Pass the unserialized value to print_r() or var_export() in place of json_encode(). The WordPress guide explains how to read serialized data as a PHP array.
Developers and AI agents can also convert without the browser form through the JSON API and MCP tool.
PHP serialization format
PHP's serialize() function represents a value using compact type markers plus length or item-count information. For example, s:5:"hello"; is a five-byte string and i:42; is an integer.
| PHP value | Serialized | JSON |
|---|---|---|
| Null | N; | null |
| Boolean | b:1; | true |
| Integer | i:42; | 42 |
| Float | d:3.5; | 3.5 |
| String | s:5:"hello"; | "hello" |
| Indexed array | a:2:{i:0;s:3:"red";i:1;s:4:"blue";} | ["red", "blue"] |
| Associative array | a:1:{s:4:"name";s:3:"Ada";} | {"name": "Ada"} |
| Reference | a:2:{i:0;s:1:"x";i:1;R:2;} | ["x", "x"] |
| Object | O:4:"User":1:{s:4:"name";s:3:"Ada";} | {"name": "Ada"} |
Example: serialized PHP array to JSON
Serialized PHP
a:2:{s:4:"name";s:6:"Chrome";s:6:"active";b:1;}
JSON
{
"name": "Chrome",
"active": true
}
Sequential integer keys become JSON arrays; associative keys become JSON objects. Null, booleans, integers, floats, strings, arrays, and nested combinations are supported. A reference (R:) becomes a copy of the value it points to. An object (O:) becomes a JSON object of its properties, private and protected ones included. Its class is never loaded, because unserializing a real object can run code; see Security and privacy.
Working with WordPress serialized data
WordPress serializes every array it saves. You find these values in wp_options (plugin settings, widget_* options and theme_mods_*) and in the meta_value column of wp_postmeta, wp_usermeta and wp_termmeta. WordPress reads them back with maybe_unserialize(), which leaves values that are not serialized alone.
Paste a value from WP-CLI or a read-only database client above to inspect it as JSON. Never change a serialized value with a plain SQL search and replace: each string stores its length in bytes, so new text with the old length breaks the value. Use wp search-replace, which re-serializes each value for you.
Read the WordPress serialized data guide to read it as a PHP array and edit it safely, or fix a broken serialized string.
Back up the database before making changes. Redact secrets and personal data before pasting a value into any web tool.
Security and privacy
Treat serialized data as untrusted input. This converter calls PHP with allowed_classes set to false, reads every object as plain data without loading its class, rejects custom-serialized objects and enums, limits input to 262,144 bytes, and caps decoding depth.
The submitted value and JSON result are processed in memory and never stored or logged. Still, remove passwords, tokens and personal data before submitting. Read the privacy and retention details for the technical metadata that is kept.
Why I built Unserialize
I kept running into serialized data while working with WordPress. The online tools I used could decode it, but they did not turn the result into clean JSON, so the data was still harder to read than it needed to be.
I built Unserialize with modern web technology to make that everyday task simpler for me—and for other developers who run into the same problem. It turns PHP serialized values into a familiar, readable format without storing the submitted input or result.
Frequently asked questions
What does unserialize mean?
To unserialize (also spelled unserialise, or called deserializing) means turning a stored string back into the value it came from. PHP's serialize() writes arrays, strings, numbers and booleans as a compact string such as a:1:{s:4:"name";s:3:"Ada";}, and unserialize() reads that string back into an array. This converter does the same reading, but shows the result as JSON instead of a PHP value.
Is PHP unserialize() the same as json_decode()?
No. Each function reads a different format. json_decode() reads JSON, such as {"name":"Ada"}. unserialize() reads PHP's own serialized format, such as a:1:{s:4:"name";s:3:"Ada";}, which stores type markers and byte lengths. If your value starts with a:, s:, i: or b:, it is serialized PHP: paste it above to get JSON. If it starts with { or [, it is already JSON.
Can I convert JSON back to serialized PHP?
Not with this converter: it only turns serialized PHP into JSON. In PHP, decode the JSON with json_decode($json, true) and pass the result to serialize(). The true makes JSON objects become associative arrays instead of stdClass objects, so the serialized value contains no objects.
Why does my serialized string fail to unserialize?
The most common cause is a wrong string length. In s:5:"hello"; the 5 is the length in bytes, not characters, so é counts as 2. A database search-and-replace that changes a URL without updating its length breaks the value. Truncated values and missing semicolons or braces fail too. When a conversion fails here, the error panel shows the exact byte where the problem starts.
How do I fix a broken serialized string?
Paste it into the converter above. When it cannot be read, the error panel marks the byte where the problem starts and, when it can, suggests the correction, such as changing s:19: to s:27:. Correct each length to the real byte count of its string. If the value was truncated, restore it from a backup instead. The guide to fixing a broken serialized string walks through each cause.
Is it safe to unserialize untrusted data?
Not with PHP's default settings. A serialized value can name a PHP class, and unserialize() will create that object and run its magic methods, which can lead to code execution. Always pass ['allowed_classes' => false], or use JSON for data you exchange. This converter never creates objects: it reads each serialized object as plain data without loading its class, rejects custom-serialized objects and enums, limits input to 262,144 bytes, and caps nesting depth.