Developer tool

PHP Serialize Viewer

Safely inspect PHP serialized strings as a readable tree without executing PHP on the server.

How it works

How to use

Paste a PHP serialized string (from cache files, session exports, or legacy options rows) into the input. The viewer parses the format and renders scalars, arrays, and object metadata in an expandable tree. Invalid serialization shows a parse error describing where the string broke.

Typical workflows

  • Audit serialize() blobs stored in MySQL before migrating to JSON
  • Compare session payloads across environments during login bugs
  • Document structure of WordPress or legacy CMS options without running unserialize() on production

Limits and safety

Never unserialize() untrusted user input in PHP—object injection is a serious vulnerability. This browser viewer parses for display only and does not instantiate PHP classes on a server. Very large serialized strings may be slow to render; redact secrets before pasting into any tool. Object instances show class names but cannot run methods here.

Object payloads blocked

This viewer rejects serialized object payloads (O: / C:). Deserializing untrusted objects is a known PHP risk. For safe primitive encoding, use the PHP Serialize Encoder with JSON literals only.

Run in browser

AJAX processing only. No remote PHP execution sandbox. Results are not indexed.

Inputs are processed for this request only and are not stored in analytics. Object unserialize and arbitrary PHP execution are blocked.

Safety notes

  • Submitted tool contents are not written to analytics or search logs.
  • This site never evaluates arbitrary PHP from the browser.
  • Generated configs are starting points—validate on a staging host before production.