PHP Serializer

The PHP Serializer runs PHP's serialize() function on the text you enter and returns the result, which always has the form s:length:"text";. Its practical use is getting the exact byte length right when you edit serialized values by hand, most often inside a WordPress database. Note that the input is treated as a single string: JSON you paste is stored as text inside the serialized value, not converted into a PHP array.

What the output means

Entering https://ethicalfusion.com returns:

s:25:"https://ethicalfusion.com";

The s marks a string and 25 is its length in bytes. Pasting {"a":1} returns s:7:"{"a":1}";, a seven-byte string that happens to contain JSON.

Bytes, not characters

PHP counts UTF-8 bytes, which matters for any text outside basic English:

• Café ₹500 is 9 characters but s:12, because é takes 2 bytes and ₹ takes 3.
• नमस्ते is 6 characters but s:18, since each Devanagari character takes 3 bytes.

Counting characters instead of bytes is the usual reason a hand-edited value refuses to load.

The format at a glance

Arrays list their element count and then each key and value: ['home' => 'http://localhost/blog'] becomes a:1:{s:4:"home";s:21:"http://localhost/blog";}. This page produces only the string form; arrays, numbers and objects need serialize() in your own PHP code.

Fixing serialized data after a site migration

WordPress stores widget settings, theme options and many plugin settings as serialized arrays in the wp_options table. Suppose a value contains s:21:"http://localhost/blog"; and a plain find-and-replace changes the URL to https://ethicalfusion.com/blog. The text is now 30 bytes, but the label still says 21, so unserialize() fails and the setting silently falls back to its default. Serialize the new URL here, copy the correct s:30:"…"; segment and replace the broken one. For a whole site, WP-CLI's wp search-replace command rewrites serialized lengths automatically and is the safer choice.

Things to keep in mind

• Spaces and line breaks at the very start and end of your input are removed before serializing, so the length reflects the trimmed text.
• Never call unserialize() on data from users or other untrusted sources; crafted input can create PHP objects and lead to code execution. For exchanging data, prefer JSON with json_encode() and json_decode(), and check JSON with the JSON Validator.

Serialization is done by PHP, so your text is sent to the EthicalFusion server and the result is returned to the page.