Serialisation

Serialisation is the process of converting a data structure or object into a format that can be stored or transmitted and then reconstructed later. The inverse operation is deserialisation, sometimes called deserializing or unmarshalling. Serialisation supports persistence and communication across program boundaries, languages, and systems.

Serialised data can be stored as binary or text. Text formats include JSON, XML, YAML, and CSV; binary formats include Java object streams, Protocol Buffers, Avro, and MessagePack. Some languages provide built‑in support for serialisation (for example Java’s Serializable, Python’s pickle, or .NET’s DataContractSerializer), but implementations differ in features and security implications. Text formats are human‑readable and flexible, while binary formats are typically more compact and faster to parse and transmit, often with strict schemas.

Serialisation is used for persistence (saving state to disk or a database), inter‑process communication, remote procedure calls, and data exchange between heterogeneous systems or services.

Common challenges include maintaining compatibility across versions, handling complex object graphs with cycles or shared references, and preserving identity. Security is a major concern: deserialising untrusted data can lead to remote code execution or other attacks; many platforms recommend safe libraries, disabling code execution during deserialisation, and validating data against schemas.

Best practices include using explicit, evolving schemas; including version information; choosing stable formats appropriate to the domain; avoiding serialising executable state; applying integrity checks and encryption for sensitive data; and selecting serializers suited to the task (for example, protocol buffers for API communication).