Java Serialization
In this page:
What is Serialization?
Serialization converts a live Java object into a byte stream that can be saved to a file or sent over a network, and later reconstructed back into an equivalent object — the class must implement the marker interface Serializable.
Example: What is Serialization?
import java.io.Serializable;
class Person implements Serializable {
String name = "Alice";
}
public class Main {
public static void main(String[] args) {
Person p = new Person();
System.out.println(p instanceof Serializable);
}
}Login to try C/C++/Java/PHP code in the editor
Writing Objects with ObjectOutputStream
ObjectOutputStream writes a serializable object's full state to an underlying stream via writeObject(), capturing every non-transient field's current value.
Example: Writing Objects with ObjectOutputStream
import java.io.*;
class Person implements Serializable {
String name = "Alice";
}
public class Main {
public static void main(String[] args) throws IOException {
ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("person.ser"));
out.writeObject(new Person());
out.close();
System.out.println("Written");
}
}Login to try C/C++/Java/PHP code in the editor
Reading Objects with ObjectInputStream
ObjectInputStream reads that byte stream back and reconstructs the object via readObject(), restoring its fields to the values they had at serialization time.
Example: Reading Objects with ObjectInputStream
import java.io.*;
class Person implements Serializable {
String name = "Alice";
}
public class Main {
public static void main(String[] args) throws IOException, ClassNotFoundException {
ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("person.ser"));
out.writeObject(new Person());
out.close();
ObjectInputStream in = new ObjectInputStream(new FileInputStream("person.ser"));
Person p = (Person) in.readObject();
in.close();
System.out.println(p.name);
}
}Login to try C/C++/Java/PHP code in the editor
Transient Fields
Marking a field transient excludes it from serialization entirely — commonly used for sensitive data like passwords, or for fields (like an open file handle) that simply can't be meaningfully saved and restored.
Example: Transient Fields
import java.io.Serializable;
class Person implements Serializable {
String name = "Alice";
transient String password = "secret"; // excluded from serialization
}
public class Main {
public static void main(String[] args) {
Person p = new Person();
System.out.println(p.password);
}
}Login to try C/C++/Java/PHP code in the editor
Safe Serialization Practices
Serialization has real security risks if you deserialize untrusted data, since a malicious byte stream can trigger unexpected code execution — only deserialize data from sources you fully trust.
Example: Safe Serialization Practices
import java.io.Serializable;
public class Main {
static class Data implements Serializable {
int value = 5;
}
public static void main(String[] args) {
System.out.println("Only deserialize data from trusted sources");
}
}Login to try C/C++/Java/PHP code in the editor
Chapter Quiz — Complete all 9 topics to unlock
0/9 topics done
Complete these topics first: