deserialization

Deserialization is the process of reconstructing data structures or objects from a serialized representation. It is the inverse of serialization. Serialized data is a sequence of bytes or text that encodes the state of an object or data structure; deserialization recreates the in-memory objects and their relationships from that encoding.

Common formats used for deserialization include JSON, XML, YAML, and binary formats such as Protocol Buffers, Avro, or language-specific forms like Java object serialization or Python pickle. Deserialization is used for data interchange, configuration loading, persistence, and remote communication in software systems.

In practice, deserialization involves parsing the serialized form, validating it against a schema or expected types, and then instantiating objects and reconstructing their graphs, including references and, where supported, polymorphic types. Frameworks may apply post-processing steps to enforce invariants, deduplicate shared references, or populate defaults after reconstruction.

Security is a major consideration. Deserializing data from untrusted sources can introduce vulnerabilities such as arbitrary code execution, data corruption, or logic errors. Some languages provide mechanisms that can execute code during deserialization, making unsafe configurations especially risky. Mitigations include validating input, restricting the set of allowable types, using schema-based or safe parsers, signing or authenticating serialized data, and avoiding native deserializers for untrusted data or replacing them with data-only formats.

Deserialization is closely related to serialization, data binding, and marshalling, and it plays a central role in applications ranging from distributed systems and messaging to configuration management and persistence.