PHP Unserialize and Serialize
Read PHP serialize() output from WordPress options, sessions, caches and queue payloads as JSON, or serialize JSON the way PHP would.
Free · No sign-up · Your inputs stay in your browser
Input
Read PHP serialized data
Output
Result
100 characters
String lengths in serialize() are counted in bytes, not characters: 'Zoë' is s:4. A search-and-replace on a database dump that changes a string's byte length breaks every serialized value it touches, which is the classic WordPress domain-migration bug. Objects are shown with their class name; nothing is instantiated.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Lengths are in bytes
A serialized string records its length in bytes, so s:4:"Zoë"; is correct because ë takes two bytes in UTF-8. Replace text in a database dump and the lengths no longer match, and unserialize() returns false for the whole value. That is the classic way a WordPress domain migration breaks widgets and theme settings; tools such as wp search-replace rewrite the lengths as they go.
Never unserialize untrusted input
The PHP manual warns that unserialize() on user input can instantiate objects whose magic methods run code. Use JSON for data that crosses a trust boundary, or pass ['allowed_classes' => false]. This tool only reads the text and never creates objects.