🔧 TL3 Tools

What Unserialize Does

Unserialize Text is a browser-based parser that converts PHP serialized strings into a formatted JSON tree. PHP serialization encodes arrays, objects, and scalars into a compact text grammar — s:5:"hello" means "a 5-character string", i:42 means "the integer 42" — and this tool reads that grammar back out for you. Take the string a:2:{i:0;s:5:"hello";i:1;i:42;}: the tool decodes it into a 2-element array whose first slot holds the string "hello" and whose second holds the integer 42. Parsing runs character by character in your browser, so nothing is ever uploaded.

Pasting a Serialized String

Decoding a payload takes a few seconds:

• Copy a serialized string from your code, database, or log output.
• Paste it into the Input textarea on the left.
• Click "Unserialize" — the decoded JSON appears instantly in the Output panel, indented so nesting is visible at a glance.
• Invalid input produces an error naming the exact character position where parsing failed.
• Export the result with "Copy" or "Download".

Who Reaches for Unserialize

• WordPress developers reading serialized option and post-meta values straight from the database.
• PHP engineers inspecting cached objects, session data, and queue payloads without writing a debug script.
• Support engineers decoding serialized fields pasted into tickets or support logs.
• Security reviewers dissecting serialized payloads while checking for unsafe deserialization.

Unserialize Questions

• Which PHP value types does it handle? All of them: null (N;), booleans (b:0 / b:1), integers (i:42), floats (d:3.14), strings (s:5:"hello"), arrays (a:count:{...}), and objects (O:Class:count:{...}), which render as a structured object with their properties.
• How does the length prefix work? The number after the type letter tells the parser how many characters to read, so the tool can walk the string deterministically and never mis-split a value that happens to contain a colon or semicolon.
• Does anything get uploaded? No. The parser is plain JavaScript running in your tab; serialized data never leaves your machine.
• What happens with malformed input? You get an error with the byte position where decoding stopped, which is usually enough to spot a truncated or corrupted payload.
• Does it work on very large payloads? Yes — the only limit is the memory your browser can spare, and large strings decode quickly because the parser skips values by length rather than scanning character by character.

How the Serialization Grammar Works

Every serialized value is a small token sequence: a type letter, a colon, the payload, and a closing semicolon. i:7; is the integer seven, b:1; boolean true, d:3.14; a float, N; null, and s:5:"hello"; a five-character string — the number after s: is the byte length and must match the quoted text exactly, or PHP refuses to read further. Arrays wrap their entries in curly braces — a:2:{i:0;s:1:"x";i:1;s:1:"y";} — and objects follow O:8:"stdClass":1:{...}, with the class-name length and property list using the same shape.

This grammar is why a one-character edit breaks everything. A length prefix claiming 12 bytes when the string holds 11 makes PHP throw a notice and abandon the parse; an unbalanced brace leaves the tail of the payload unread. Telling those two failures apart matters, because a truncated entry (missing closing brace) usually means a half-written cache or session file, while a wrong length prefix often means a text editor introduced a newline or a script escaped the quotes twice.

Where You Meet Serialized Data

The classic habitats are WordPress options and post-meta tables, WooCommerce cart contents, PHP session files, and the cookies older frameworks left behind. Laravel and Symfony have largely moved to JSON, but countless plugins and legacy applications still hand out serialized blobs — frequently double-encoded, so the outer string holds an inner payload surrounded by escaped quotes. If the decoded output is a string that looks serialized again, run it through the tool a second time; that inner value is usually the data you actually wanted.

You may also meet serialization tucked inside other formats: a base64 envelope wrapping a serialized body in an API response, or a serialized object quoted inside a CSV cell or an email header. This tool reads raw serialization only, so strip any base64 or JSON wrapper by hand first, then paste the remainder and let the parser show you the nesting.

A Word About Security

Never feed this tool — or any live unserialize() call — data you do not trust. Deserializing attacker-controlled input can instantiate arbitrary classes and trigger magic methods such as __wakeup and __destruct, the classic PHP object-injection attack that gadget chains like PHPGGC weaponize. Modern PHP refuses unknown classes by default, but older codebases remain exposed. The safe pattern is to store structured data as JSON and reserve serialization for values your own code wrote; when legacy data forces the issue, wrap the call in a strict allowlist of permitted class names.