PHP Serialize ↔ JSON

Convert PHP serialized strings to JSON and back. Handles strings, integers, arrays, and objects.

PHP Serialized

JSON

[]

PHP Serialize to JSON Converter

PHP's serialize() function creates a string representation of a value that can be stored and restored. It is common in WordPress options, session data, and caches. The format encodes type information: s:5:"hello" is a 5-character string, a:2:{...} is an array with 2 elements. This converter handles nested arrays and objects.

Built and maintained by Meet Shah · Last updated 1 August 2026

What this tool is used for

Reading a serialized value out of a WordPress options table to see what a plugin actually stored.
Converting a legacy serialized payload into JSON so a modern service can consume it.
Diagnosing why a serialized string fails to unserialize, usually a length prefix that no longer matches.
Producing a serialized value by hand to seed a fixture in a PHP test.
Comparing two serialized blobs by converting both to JSON first.

Frequently Asked Questions

What does PHP serialized data look like?: Type-tagged with explicit lengths: s:5:"hello" is a 5-character string, i:42 an integer, a:2:{...} a 2-element array, and O:8:"ClassName" an object. The lengths are why hand-editing almost always corrupts it.
Why does editing serialized data break it?: Because the byte length is stored alongside every string. Changing 'hello' to 'hi' without updating s:5 to s:2 makes the payload unparseable — the classic failure when search-replacing a WordPress database during a domain migration.
Is unserializing untrusted data dangerous?: Extremely. PHP object injection is a well-known RCE class: a crafted O: payload instantiates arbitrary classes and triggers their magic methods. Never unserialize user input — use json_decode, which cannot instantiate objects.
What is lost converting to JSON?: Class identity, private and protected member markers (PHP encodes those with null bytes in the key), object references, and the integer/string key distinction. The data survives; the PHP-specific type information does not.
Where will I run into this?: WordPress options and post meta, older Laravel sessions, Magento configuration, and legacy PHP caches. Migrating any of them to a non-PHP system means converting this format.
What do the letters at the start of each segment mean?: They are type tags: `s` string, `i` integer, `d` float, `b` boolean, `a` array, `O` object, `N` null. The number after a string is its length in BYTES, not characters, which is why multi-byte text needs care when editing by hand.
How are private and protected properties encoded?: With null bytes in the property name — `\0ClassName\0prop` for private and `\0*\0prop` for protected. Those bytes are invisible in most editors, so a name that looks correct can be silently wrong.
Does PHP's JSON output match this conversion?: Not exactly. `json_encode` skips private and protected properties unless the class implements `JsonSerializable`, so a round trip through JSON quietly drops state that the serialized form preserved.

Common errors and gotchas

Editing a serialized string by hand without updating the byte-length prefix, which makes it unparseable.
Assuming the length counts characters. It counts bytes, so any multi-byte character breaks a naive edit.
Expecting object types to survive the round trip. Class names are recorded, and JSON has nowhere to put them.
Confusing an integer key with a string key, which serialize distinguishes and JSON does not.
Feeding in a base64-wrapped value without decoding it first, then reading the failure as a format problem.