PHP serialize / unserialize
Convert JSON to PHP's serialize() format and back. Covers null/bool/int/float/string/array. PHP objects (O:) are not implemented since they need a class registry this tool doesn't have. Runs on your device.
Runs on your device. The file is never uploaded.
PHP serialize / unserialize turns JSON into the text that serialize() writes, and unserialize mode reads that text back as JSON. String lengths are counted in bytes, so an accented letter adds two. An array whose keys are not 0 upwards in order comes back as a JSON object of strings, not an array.
Questions
What does this tool do?
It converts JSON into the text format PHP serialize() produces, and reads that format back into JSON. Serialize is the default mode; switch to unserialize for the other direction, which prints JSON with 2-space indentation. It is useful for reading a serialized value out of a database column without a PHP process to hand.
Which PHP types are covered?
null as N;, booleans as b:0; and b:1;, whole numbers as i:, fractional ones as d:, strings as s:length:"value"; and arrays as a:count:{...}. Objects, the O: form, are not implemented, because rebuilding one needs a class registry this tool does not have, and hitting an O: while unserializing reports that.
How are arrays and objects represented?
PHP has one array type that is an ordered map, so a JSON array is written with the integer keys 0 to n minus 1, and a JSON object is written with its string keys. Coming back, you get a JSON array only when the keys are exactly 0 to n minus 1 in order; anything else becomes a JSON object with string keys.
Does it get string lengths right for non-ASCII text?
Yes. PHP counts bytes, not characters, so the length written is the UTF-8 byte length. A five-character string containing one accented letter is written as s:6. Unserialize walks by byte length in the same way, so accented text and emoji survive the round trip.
Is the output safe to feed to PHP unserialize?
It contains only arrays and scalar values, never an O: object, so it never names a class and cannot trigger object construction on the PHP side. That said, the usual advice still applies: do not unserialize data from a source you do not trust, whatever produced it.
Does the data get uploaded?
No. Both directions run in a Web Worker in this tab, with nothing sent to a server and nothing retained. Serialized blobs pulled out of a database often carry session contents or user data, so it is worth being explicit: the file you drop is read in the tab and forgotten when you close it.