Serialization

Serialization is the process of converting an in-memory data structure or object into a sequence of bytes or text that can be stored or sent over a network. Deserialization is the reverse: rebuilding the object from that representation.

Why it matters

Programs cannot send a live object over HTTP or write it to a file directly, so they serialize it first. Common formats include JSON, XML, YAML, Protocol Buffers and MessagePack, which differ in readability, size, speed and schema support. Deserializing untrusted data is a security risk: some formats and libraries, such as Java native serialization or Python pickle, can execute code or create arbitrary objects, which has caused many vulnerabilities. Changes to the data's shape also need care so old and new versions stay compatible.

Example

import json

site = {"host": "example.com", "up": True}
text = json.dumps(site)        # '{"host": "example.com", "up": true}'
copy = json.loads(text)        # back to a dict

Common mistakes

• Using pickle or native object deserialization on untrusted input.
• Assuming every type survives; dates, large numbers and binary data often need special handling in JSON.
• Changing field names without versioning, breaking older readers.

Related

• JSON
• XML
• YAML
• REST API

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.