🔧 TL3 Tools

What Is This Tool?

Unserialize PHP Serialized Text takes a PHP serialized string — the output of PHP's serialize() function — and converts it into a readable, pretty-printed JSON representation. PHP's serialization format is a compact, type-prefixed string notation: strings are encoded as s:5:"hello", integers as i:42, floats as d:3.14, booleans as b:1 (true) or b:0 (false), null as N;, arrays as a:N:{...} with key-value pairs, and objects as O:class_name:count:{...}. The tool implements a full JavaScript-based parser that reads this notation token by token, recursively resolving nested structures, custom serialized objects, and even internal references (r:N). The parsed result is then serialized to formatted JSON with 2-space indentation, making even deeply nested serialized data immediately comprehensible.

How to Use This Tool

• Step 1 — Copy a PHP serialized string from its source: a WordPress database dump, a session file, a cache store like Memcached or Redis, or a PHP error log. Example format: a:2:{i:0;s:5:"hello";i:1;s:5:"world";}
• Step 2 — Paste the full serialized string into the Input textarea. Make sure you include the entire string — partial data will cause a parse error.
• Step 3 — Click "Unserialize". The tool parses the string and displays the result as formatted JSON in the Output panel.
• Step 4 — Inspect the structure or click Copy to copy the JSON to your clipboard for further analysis or import into another tool.

Who Needs This Tool?

• WordPress developers and site administrators — WordPress stores a vast amount of data in serialized format: theme options, widget settings, post meta, and plugin configurations all live in the database as serialized strings. When debugging a misconfigured plugin or inspecting a database migration, this tool lets you peek inside those opaque strings without writing PHP code.
• PHP application developers — If you are building or maintaining a PHP application that uses session_encode(), cached API responses, or serialized queue messages, this tool helps you verify that the data being stored and retrieved matches your expectations.
• Security researchers and QA engineers — PHP object injection vulnerabilities often involve crafted serialized strings. Being able to inspect the raw serialized format helps in understanding how an attacker might manipulate object properties and what the resulting structure looks like.
• Data migration specialists — When moving data between systems, serialized PHP strings in database dumps need to be understood before they can be transformed. This tool converts them to JSON, a format that virtually every modern system can work with.

Frequently Asked Questions

What does a PHP serialized string look like?
A typical array serialization looks like a:3:{i:0;s:5:"apple";i:1;s:6:"banana";i:2;s:5:"cherry";}. The a:3 means "array with 3 elements", i:0 is integer key 0, s:5:"apple" is a 5-character string "apple", and so on. An object looks like O:8:"stdClass":1:{s:4:"name";s:4:"John";}.

Does the tool support serialized objects?
Yes. The parser handles PHP objects (the O: type) and custom serialized objects (the C: type), outputting them as JSON objects with their class name preserved in a __php_class__ property for transparency.

What happens if the serialized string is invalid?
The parser returns a descriptive error message indicating where the parse failed — for example, "Unexpected token at position 42: expected string length". This helps you identify truncated data, manual editing errors, or corruption in the serialized string.

Can I convert JSON back to a PHP serialized string?
This tool is one-directional — it only unserializes PHP to JSON. If you need to go the other direction, PHP's unserialize() and serialize() functions or a dedicated serialization library would be appropriate.