PHP Unserialize Viewer & Serialized String Fixer

Paste a value like a:2:{s:4:"name";s:4:"Sara";...} from a database column (WordPress wp_options, WooCommerce meta, Laravel cache or session) and read it clearly. If it is broken after a search-and-replace, repair the lengths in one click.

FreeNo sign-upRuns in your browser: your data is not uploaded

Serialized PHP data (or JSON, to serialize it)

Where you meet serialized PHP data

PHP's serialize() turns arrays and objects into one string so they can be stored in a single database column. You will see it in:

WordPress: wp_options (widgets, theme settings, plugin options), wp_postmeta and wp_usermeta.
WooCommerce: order item meta and product attributes.
Laravel: the database cache and session drivers, and queued job payloads.
Older custom PHP apps that save settings as one text field.

How to read the format

Every value starts with a letter that tells you its type:

Piece	Meaning
`s:6:"Faizan";`	string, 6 bytes long
`i:42;` / `d:1.5;`	integer / float
`b:1;`	boolean true (`b:0;` is false)
`N;`	null
`a:2:{...}`	array with 2 key/value pairs
`O:4:"User":3:{...}`	object of class `User` with 3 properties

The number after s: is the length in bytes, not characters. "héllo" is 5 characters but 6 bytes, and an Arabic or Urdu word uses 2 bytes per letter. That detail is behind most broken values.

Why serialized data breaks after a domain change

You move a WordPress site from old-domain.com to new-domain.com and run a plain SQL REPLACE() or a text-editor find-and-replace on the dump. The URL inside s:23:"https://old-domain.com/" changes length, but the 23 does not. PHP's unserialize() then fails, returns false, and WordPress quietly falls back to defaults. Widgets vanish, the theme loses its settings, and a plugin acts as if it was just installed.

The Fix string lengths button recalculates every s:N from the real byte length of the text. It first tries a fast pass and checks the result with a full parser. If a value contains tricky text such as ";, it falls back to a careful mode that tries each possible end of the string and keeps only the version that makes the whole value valid.

Safer ways to change a domain

Use wp search-replace 'https://old-domain.com' 'https://new-domain.com' --all-tables (WP-CLI). It unserializes, replaces and serializes again, so lengths stay right.
Or use a migration plugin that handles serialized data.
Use this page for the one or two values that are already broken, then paste the fixed value back with phpMyAdmin.

Editing a value and saving it back

Paste the value and choose JSON view.
Copy the JSON into the input, change what you need (keep the quotes and commas valid).
Press JSON → serialize. The output has correct byte lengths.
Back up the row, then paste the new value into the database.

Objects keep their class name in a __class key in the JSON view, so they are serialized back as objects.

FAQ

Is it safe to paste data from my live site?

The page runs entirely in your browser; nothing you paste is sent anywhere. Still, values can hold e-mail addresses or API keys, so treat the browser tab like any other place you view production data.

Why does unserialize() return false in PHP?

Almost always a wrong string length (after a search-and-replace or a character-set conversion), a value cut off by a too-short database column, or quotes escaped twice by an import. Paste it here: the error message shows the byte position where reading stopped.

Can this run unserialize on objects safely?

Yes. This tool never runs PHP and never creates objects; it only reads the text. Running PHP's own unserialize() on data you do not trust is risky (object injection), which is why reading it here is safer.

What do "protected" and "private" mean in the tree?

PHP stores protected properties with a \0*\0 prefix and private ones with \0ClassName\0. The tree shows the clean name and marks its visibility.

Does it support PHP 8.1 enums?

Yes. Enum values (E:) are shown as Class:Case, and in the PHP view as Class::Case.

Related guides

Link to this tool

Found it useful? Put a link in your docs, README or forum answer so others can use it too:

HTML

<a href="https://headsntail.com/tools/php-unserialize">PHP Unserialize Viewer & Serialized String Fixer</a> (free, by HeadsNTail)

Markdown (GitHub, Stack Overflow, dev.to)

[PHP Unserialize Viewer & Serialized String Fixer](https://headsntail.com/tools/php-unserialize)

Need it done on your server? HeadsNTail sets up Laravel apps, cPanel hosting and migrations for businesses. See services or ask a question.

More free tools

SQL to Laravel Migration ConverterPaste CREATE TABLE, get a ready Laravel migration file with foreign keys, indexes and timestamps. .htaccess Generator for cPanelForce HTTPS, remove www, 301 redirects, Laravel public folder, caching and security headers. Tested rules. Cron Job Generator for cPanel & LaravelBuild or explain a cron expression, see the next run times, and copy the exact cPanel line for the Laravel scheduler or a queue worker. Bcrypt Hash Generator & Laravel APP_KEYCreate a PHP/Laravel compatible bcrypt hash, check a password against a hash, or generate a new APP_KEY. Unix Timestamp to Date Converter (MySQL, PHP)Convert Unix time to MySQL DATETIME and back in any time zone, with ready PHP, Carbon and SQL snippets. JSON to PHP Array Converter (and back)Turn JSON into a clean PHP array for config files and tests, or turn a PHP array into JSON. Key order kept.