Java Serialization and Deserialization with Serializable

🔍 What Is It?

Java serialization writes an object's state to a byte stream; deserialization reconstructs an object from that stream. For ordinary classes, implement Serializable and use ObjectOutputStream.writeObject and ObjectInputStream.readObject. This native Java format is different from JSON serialization with Jackson.

Java Built-in Serialization:

• →Implement java.io.Serializable (marker interface)
• →Use ObjectOutputStream to serialize, ObjectInputStream to deserialize
• →serialVersionUID — version ID for compatibility checking
• →transient — exclude fields from serialization
• →readObject/writeObject — customize serialization behavior

What gets serialized:

• →All non-transient, non-static instance fields
• →Recursively: all referenced objects (must also be Serializable)

Externalizable:

• →More control: you implement readExternal/writeExternal
• →Owns the stream format and its versioning; performance depends on the implementation
• →Requires a public no-arg constructor

Modern Alternatives:

• →JSON (Jackson, Gson) — human-readable, language-neutral, widely supported
• →Protobuf — binary, fast, schema-based, language-neutral
• →Avro — schema-based, great for Kafka
• →Kryo — fast Java binary serialization (not language-neutral)
• →Records — immutable data classes, serialize well with Jackson

🎯 Why Do We Need It?

Serialization is needed for:

• →Persistence — save objects to disk (session state, caches)
• →Network transmission — send objects over the network (RMI, Kafka, Redis)
• →Caching — store objects in distributed caches (Redis, Hazelcast)
• →Deep copy — serialize and deserialize to create a deep copy

However, Java's built-in serialization has serious problems: security vulnerabilities (deserialization attacks), tight coupling to class structure, poor performance. Use JSON or Protobuf instead.

🏗️ What Happens in Real Projects?

In enterprise Java:

• →REST APIs — Jackson for JSON serialization/deserialization
• →Kafka — Avro or JSON for message serialization
• →Redis cache — JSON serialization via Spring Data Redis
• →HTTP sessions — built-in serialization (if distributed session storage)
• →JPA — not serialization; JPA maps objects to SQL directly

⚙️ How It Works

Built-in serialization process:

1. ObjectOutputStream writes class descriptor (class name, serialVersionUID, field names/types)
2. Writes field values recursively
3. On deserialization: checks class compatibility and reconstructs the object. For ordinary Serializable classes, their constructors are skipped, but the first non-serializable superclass's accessible no-arg constructor runs. Externalizable classes and serializable records have different construction rules.

serialVersionUID:

If not declared, Java computes a UID from class details. Structural changes can change that value and prevent old streams from being read. Declare a stable UID for compatible evolution, then evaluate the actual change: adding a field can be compatible, while changing a field's type can be incompatible even with the same UID. Matching UIDs alone do not make every schema change safe.

Security issue:

Deserializing untrusted data can execute arbitrary code (gadget chains). Never deserialize data from untrusted sources with Java built-in serialization.

💻 Example

Serialization Patterns — When to use built-in serialization and modern alternatives.

import java.io.*;

public class SerializationDemo {
    private static class User implements Serializable {
        private static final long serialVersionUID = 1L;
        String name;
        transient String token;

        User(String name, String token) {
            this.name = name;
            this.token = token;
        }
    }

    public static void main(String[] args) throws Exception {
        byte[] bytes;
        try (ByteArrayOutputStream buffer = new ByteArrayOutputStream();
             ObjectOutputStream output = new ObjectOutputStream(buffer)) {
            output.writeObject(new User("Sam", "temporary-token"));
            output.flush();
            bytes = buffer.toByteArray();
        }

        // Read only the bytes created above, not data from an untrusted client.
        try (ObjectInputStream input = new ObjectInputStream(
                new ByteArrayInputStream(bytes))) {
            User restored = (User) input.readObject();
            System.out.println(restored.name);  // Sam
            System.out.println(restored.token); // null: transient field
        }
    }
}

🤔 Common Confusions

🚨 Common Production Issues

✅ Best Practices

🏛️ Architect's Note

💬 Frequently Asked Questions

🎯 Key Takeaways

🔗 Related Topics

🎯 Practice this topic in interviews

↗ Where this topic fits