PHP Unserialize
Convert serialized strings to PHP arrays/objects. Paste your serialized string below.
Reading Serialized Strings Without a PHP Shell
A serialized PHP value like a:2:{s:4:"name";s:5:"Alice";s:3:"age";i:30;} is hard to scan by eye once it's nested a few levels deep. This tool runs the equivalent of PHP's unserialize() in your browser and lets you view the result as print_r (PHP's own readable dump), var_dump (adds type info per value), var_export (valid PHP code you can paste back into a script), or json_encode (for handing the structure to a non-PHP tool).
Choosing an Output Format
print_r
The fastest way to eyeball nested arrays — indentation shows structure, but it doesn't distinguish an integer 1 from a string "1".
var_dump
Use this when a bug depends on type — it labels every value with its type and, for strings, its byte length, which is often exactly what you need when debugging a failed comparison.
var_export
Produces a copy-pasteable PHP array literal, useful for turning a value pulled from a database dump into a fixture for a test or a hardcoded default in code.
json_encode
Converts the decoded structure to JSON so you can hand it to a frontend tool, a non-PHP script, or another formatter on this site (like the JSON Parser).
When Unserializing Fails
A serialized string almost always fails to decode for one of these reasons: the length prefix on a string no longer matches its actual byte length (usually from manual editing or a copy-paste that dropped characters), the data was truncated when copied out of a database column, or it contains multi-byte UTF-8 characters where the byte count differs from the visible character count. If decoding fails here, check the string for a missing closing brace or a stray trailing character first — those are the most common culprits.
Frequently Asked Questions
Is this safe to use on untrusted serialized data?
This tool only decodes and displays the structure — it never executes PHP's real unserialize(), which is the function actually associated with PHP object-injection risks when fed untrusted input in a live application.
Can I convert the result straight to JSON?
Yes — select the json_encode output format and the decoded structure is rendered as JSON directly.
Does this send my data anywhere?
No, decoding happens locally in your browser's JavaScript engine; nothing you paste is transmitted or stored.
Can I go from a PHP array back to a serialized string?
Use the companion Serialize tool for the reverse conversion.