JSON vs PHP serialization for an internal round trip
Timing and output-size comparison for JSON and native PHP serialization of the same nested data.
The choice this benchmark informs
How do JSON and PHP serialize/unserialize compare when a PHP-only process stores and reloads a nested payload?
Cache payloads are often encoded without documenting whether they must survive language changes, be inspected by operators or cross a trust boundary.
Native unserialize has security implications for untrusted input, especially when object instantiation is permitted. This experiment disables classes and does not endorse decoding attacker-controlled payloads.
Result and trade-off
What this run shows: PHP serialize round trip produced the lower round-trip median in this PHP-only fixture. Interoperability and long-term storage compatibility can reverse the recommendation. The slowest-to-fastest median spread was 76.58% on the measured host.
| Variant | Median | Middle 50% | Operations/s | Additional measure |
|---|---|---|---|---|
| PHP serialize round tripFastest | 425.05 µs | 420.63 µs–429.56 µs | 2,353 | 106,020 output bytes |
| JSON round trip | 750.56 µs | 743.85 µs–861.24 µs | 1,332 | 67,457 output bytes |
Timing and extra output metrics are calculated directly from the downloadable samples.
How to interpret the difference
A PHP-only cache can legitimately prioritize local speed, but portability and operational transparency are long-lived architectural properties.
Use the measured result only after deciding whether non-PHP consumers, manual inspection, schema evolution or untrusted input are relevant.
Decision rules
- Use JSON for interoperable storage and external interfaces.
- Keep native serialization limited to trusted, PHP-controlled data paths.
- Version cache payloads so encoding changes can be rolled out safely.
Fixture and measurement design
Native serialization may be competitive for PHP-only data, while JSON offers stronger interoperability and inspectability.
- Both variants encode and then decode the same 400-record nested array.
- The JSON path uses explicit exception handling. The native path disables allowed classes during unserialize.
- Output byte length is recorded for the encoded form.
Open measured environment
- Measurement run
- 2026-07-22T15:23:56+00:00
- PHP
- 8.4.23 (cli)
- Operating system
- Linux 4.18.0-553.85.1.el8_10.x86_64
- Architecture
- x86_64
- Processor
- AMD EPYC-Rome Processor
- Reported host memory
- 15.02 GiB host total
- CLI OPcache
- 0
- PHP memory limit
- 1024M
- Loaded study extensions
- json, openssl, zlib, mbstring, pdo_sqlite
- Timing clock
- hrtime(true)
- Measured rounds
- 7
Where this result stops
- Objects, references and custom serialization hooks are not tested.
- Compression and persistent cache-network latency are excluded.
Primary documentation
These primary sources define the formats and APIs involved. They should be read alongside the measured host data, not replaced by it.