Java Serialization
In this page:
class ClassName implements Serializable {
// fields
}
ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("file"));
out.writeObject(object);What is Serialization?
Serialization converts a live Java object into a byte stream that can be saved to a file or sent over a network, and later reconstructed back into an equivalent object — the class must implement the marker interface Serializable.
Example: What is Serialization?
// Import java.io.Serializable so it can be used by its short name
import java.io.Serializable;
// Define the class Person
class Person implements Serializable {
// Declare name and set it to "Alice"
String name = "Alice";
}
// Define the class Main
public class Main {
// Program entry point: the JVM starts running here
public static void main(String[] args) {
// Create a new Person object and store it in p
Person p = new Person();
// Print a line to the console
System.out.println(p instanceof Serializable);
}
}Login to try C/C++/Java/PHP code in the editor
Writing Objects with ObjectOutputStream
ObjectOutputStream writes a serializable object's full state to an underlying stream via writeObject(), capturing every non-transient field's current value.
Example: Writing Objects with ObjectOutputStream
// Import java.io.* so it can be used by its short name
import java.io.*;
// Define the class Person
class Person implements Serializable {
// Declare name and set it to "Alice"
String name = "Alice";
}
// Define the class Main
public class Main {
// Program entry point: the JVM starts running here
public static void main(String[] args) throws IOException {
// Create a new ObjectOutputStream object and store it in out
ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("person.ser"));
out.writeObject(new Person());
out.close();
// Print a line to the console
System.out.println("Written");
}
}Login to try C/C++/Java/PHP code in the editor
Reading Objects with ObjectInputStream
ObjectInputStream reads that byte stream back and reconstructs the object via readObject(), restoring its fields to the values they had at serialization time.
Example: Reading Objects with ObjectInputStream
// Import java.io.* so it can be used by its short name
import java.io.*;
// Define the class Person
class Person implements Serializable {
// Declare name and set it to "Alice"
String name = "Alice";
}
// Define the class Main
public class Main {
// Program entry point: the JVM starts running here
public static void main(String[] args) throws IOException, ClassNotFoundException {
// Create a new ObjectOutputStream object and store it in out
ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("person.ser"));
out.writeObject(new Person());
out.close();
// Create a new ObjectInputStream object and store it in in
ObjectInputStream in = new ObjectInputStream(new FileInputStream("person.ser"));
Person p = (Person) in.readObject();
in.close();
// Print a line to the console
System.out.println(p.name);
}
}Login to try C/C++/Java/PHP code in the editor
Transient Fields
Marking a field transient excludes it from serialization entirely — commonly used for sensitive data like passwords, or for fields (like an open file handle) that simply can't be meaningfully saved and restored.
Example: Transient Fields
import java.io.Serializable;
class Person implements Serializable {
String name = "Alice";
transient String password = "secret"; // excluded from serialization
}
public class Main {
public static void main(String[] args) {
Person p = new Person();
System.out.println(p.password);
}
}Login to try C/C++/Java/PHP code in the editor
Safe Serialization Practices
Serialization has real security risks if you deserialize untrusted data, since a malicious byte stream can trigger unexpected code execution — only deserialize data from sources you fully trust.
Example: Safe Serialization Practices
// Import java.io.Serializable so it can be used by its short name
import java.io.Serializable;
// Define the class Main
public class Main {
// Define the class Data
static class Data implements Serializable {
// Declare value and set it to 5
int value = 5;
}
// Program entry point: the JVM starts running here
public static void main(String[] args) {
// Print a line to the console
System.out.println("Only deserialize data from trusted sources");
}
}Login to try C/C++/Java/PHP code in the editor
- Forgetting to implement
Serializable, which throwsNotSerializableException. - Expecting
transientfields to be saved, when they are skipped and read back as default values. - Casting the read object to the wrong class, which throws
ClassCastException.
Chapter Quiz — Complete all 9 topics to unlock
0/9 topics done
Complete these topics first: