🌐
Payloads All The Things
swisskyrepo.github.io › PayloadsAllTheThings › Insecure Deserialization › Java
Java Deserialization - Payloads All The Things
Java serialization is the process of converting a Java object’s state into a byte stream, which can be stored or transmitted and later reconstructed (deserialized) back into the original object.
🌐
GeeksforGeeks
geeksforgeeks.org › java › serialization-and-deserialization-in-java
Serialization and Deserialization in Java - GeeksforGeeks
June 2, 2025 - This interface does not contain ... is ready for serialization. Deserialization is the reverse process where the byte stream is used to recreate the actual Java object in memory....
Discussions

java - How Deserialization works? - Stack Overflow
As far as my understanding goes constructor of class whose Object is serialized is not called but the no-arg constructor of 1st non serializable constructor. Now consider following code public class More on stackoverflow.com
🌐 stackoverflow.com
What is Deserialize & Serialize?
When you need to get data out of your program, out of it's process memory, you need to shape it in a linear string - serialize. It doesn't have to be a text string, you have standard binary serialization formats, or you can roll your own (don't). And on the other side, you deserialize from this linear string into objects stored in (another) program's process memory. You most often can't just raw copy data from process memory because that data is not tagged, in no standard order or format, not linear, not stored in one place, or contains information that would be wrong in other program's memory, like pointers and metadata. More on reddit.com
🌐 r/algorithms
6
7
December 11, 2016
Java serialization/deserialization?
Please ensure that: Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions You include any and all error messages in full - best also formatted as code block You ask clear questions You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions. If any of the above points is not met, your post can and will be removed without further warning. Code is to be formatted as code block (old reddit/markdown editor: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png ) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc. Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit. Code blocks look like this: public class HelloWorld { public static void main(String[] args) { System.out.println("Hello World!"); } } You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above. If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures. To potential helpers Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice. I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns. More on reddit.com
🌐 r/learnjava
9
5
April 15, 2024
Explain like i'm five - what is Serializable?
Please ensure that: Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions You include any and all error messages in full You ask clear questions You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions. Trying to solve problems on your own is a very important skill. Also, see Learn to help yourself in the sidebar If any of the above points is not met, your post can and will be removed without further warning. Code is to be formatted as code block (old reddit: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png ) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc. Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit. Code blocks look like this: public class HelloWorld { public static void main(String[] args) { System.out.println("Hello World!"); } } You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above. If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures. To potential helpers Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice. I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns. More on reddit.com
🌐 r/javahelp
9
24
April 26, 2024
🌐
Hazelcast
hazelcast.com › home › deserialization
What is deserialization and how does it work? | Hazelcast
July 22, 2025 - Deserialization is the process of reconstructing a data structure or object from a series of bytes or a string in order to instantiate the object for consumption.
🌐
Snyk
snyk.io › blog › serialization-and-deserialization-in-java
Serialization and deserialization in Java | Snyk Blog | Snyk
December 18, 2020 - Deserialization is precisely the opposite of serialization. With deserialization, you start with a byte stream and re-create the object you previously serialized in its original state.
🌐
Medium
medium.com › @pratik.941 › serialization-and-deserialization-in-java-6dbd11fd31b3
Serialization and Deserialization in Java | by Pratik T | Medium
July 29, 2024 - 2. What is deserialization in Java? — Answer: Deserialization is the reverse process of serialization.
🌐
Scaler
scaler.com › home › topics › java › serialization and deserialization in java with example
Serialization and Deserialization in Java with Example - Scaler Topics
February 22, 2024 - However, we must convert these byte streams back to their respective Objects to use them again. This reverse process of converting an object into byte-stream is called Deserialization...
🌐
Great Learning
mygreatlearning.com › blog › it/software development › serialization and deserialization in java with examples
Serialization and Deserialization in Java with Examples
June 27, 2025 - Deserialization is the reverse process of serialization. It converts a byte stream back into an object. This reconstructs the object in memory. You use the ObjectInputStream class to deserialize objects.
🌐
Codementor
codementor.io › java › tutorial › serialization-and-deserialization-in-java
Serialization and Deserialization in Java | Codementor
This process of writing the object state into a byte stream is known as Serialization. Eventually, we can use this byte stream to retrieve the stored values and restore the object’s old state. This process of restoring the object’s old state is known as Deserialization. Similar to a multi-tier JAVA/J2EE application (client-server RMI applications), when we make a remote invocation method or RMI from a web tier to app tier, we need to send the data value object that transfers the required business information from web tier to app tier after Serialization (we implement java.io.
Find elsewhere
🌐
Scaler
scaler.com › home › topics › java › serialization and deserialization
serialization and deserialization - Java
March 28, 2024 - In deserialization, an object is reconstructed back from the sequence of bytes. In Java, Serialization and deserialization play a great role in the transfer of data and saving it to a database or disk.
🌐
GeeksforGeeks
geeksforgeeks.org › serialization-in-java
Serialization and Deserialization in Java with Example | GeeksforGeeks
January 4, 2025 - Serialization is a mechanism of converting the state of an object into a byte stream. Deserialization is the reverse process where the byte stream is used to recreate the actual Java object in memory. This mechanism is used to persist the object.
🌐
Java Training School
javatrainingschool.com › home › deserialization in java
Deserialization in Java - Java Training School
April 15, 2023 - Deserialization in Java is the process of converting an object in a serialized form, which is a sequence of bytes, back into its original object form. This process is important in situations where objects need to be stored, transmitted or otherwise ...
🌐
Medium
medium.com › @salvipriya97 › serialization-and-deserialization-explained-with-examples-5e2e45af97ee
Serialization and Deserialization explained with examples | by Priya Salvi | Medium
January 9, 2024 - Java Interface: The Serializable interface in Java is a marker interface that indicates a class can be serialized. Definition: Deserialization is the process of reconstructing an object from a byte stream.
🌐
Medium
medium.com › @mesfandiari77 › exploring-serialization-and-deserialization-in-java-7c64d03bda52
Exploring Serialization and Deserialization in Java | by MEsfandiari | Medium
September 26, 2024 - Serialization and deserialization in Java are fundamental techniques for converting objects into a storable or transmittable format and then reconstructing them when needed. They are widely used in various scenarios, including data persistence, network communication, and caching.
🌐
Quora
quora.com › What-is-the-difference-between-serialization-and-deserialization-in-core-Java
What is the difference between serialization and deserialization in core Java? - Quora
Answer (1 of 5): Serialization ... object into a byte stream. Deserialization is the reverse process where the byte stream is used to recreate the actual Java object in memory. This mechanism is used ......
🌐
Baeldung
baeldung.com › home › core concepts › programming › what are serialization and deserialization in programming?
What Are Serialization and Deserialization in Programming? | Baeldung on Computer Science
March 18, 2024 - Deserialization is the reverse process of serialization. It involves taking a byte stream and converting it back into an object. This is done using the appropriate tools to parse the byte stream and create a new object.
🌐
Javalaunchpad
javalaunchpad.com › home › serialization and deserialization in java
Serialization and Deserialization in Java
January 4, 2025 - This code illustrates the deserialization process, where a previously serialized Person object is read from the file person.ser and reconstructed in memory. The ObjectInputStream is used to read the object, and the try-with-resources block ensures the stream is properly closed. The serialVersionUID is a unique identifier used during the serialization and deserialization of Java objects to verify compatibility between the sender and receiver of a serialized object.
🌐
Mkyong
mkyong.com › home › java › java serialization and deserialization examples
Java Serialization and Deserialization Examples - Mkyong.com
October 6, 2021 - In Java, Serialization means converting Java objects into a byte stream; Deserialization means converting the serialized object’s byte stream back to the original Java object.
🌐
Wikipedia
en.wikipedia.org › wiki › Serialization
Serialization - Wikipedia
3 weeks ago - This process of serializing an object is also called marshalling in some situations. The opposite operation, extracting a data structure from a series of bytes, is deserialization (also called unserialization or unmarshalling).
🌐
OWASP Cheat Sheet Series
cheatsheetseries.owasp.org › cheatsheets › Deserialization_Cheat_Sheet.html
Deserialization - OWASP Cheat Sheet Series
Note that this addresses "billion ... checking input length and number of objects deserialized. Be aware of the following Java API uses for potential serialization vulnerability. 1. XMLdecoder with external user defined parameters · 2. XStream with fromXML method (xstream version <= v1.4.6 is vulnerable ...