Serialization

Serialization is the process of converting an object's state into a byte stream so it can be saved to a file, sent over a network, or stored elsewhere, and later reconstructed through deserialization. Java supports this natively through the Serializable marker interface and the ObjectOutputStream/ObjectInputStream classes.

Why it matters

Serialization is how an object leaves the JVM: to a file, a cache such as Redis, an HTTP session store or another service. Java's built-in mechanism is in a great deal of existing code, and the ideas behind it, such as which fields are saved, what happens when the class changes, and why untrusted input is dangerous, apply equally to JSON and every other format.

The Serializable Marker Interface

java.io.Serializable declares no methods at all — it is a "marker interface" that simply tells the JVM this class is allowed to be serialized. If an object's class (or any superclass, for non-static fields) does not implement Serializable, attempting to serialize it throws a NotSerializableException at runtime. Every field referenced by the object must itself be serializable (or null), including nested objects.

Excluding Fields with transient

The transient keyword marks a field that should be skipped during serialization — useful for sensitive data (like passwords), derived/cacheable values that can be recomputed, or fields holding non-serializable resources (like open sockets or threads). Transient fields are written out as their type's default value (0, false, or null) when the object is deserialized.

serialVersionUID and Version Control

serialVersionUID is a static final long field used to verify that a serialized object's class version matches the version used to deserialize it. If you don't declare one explicitly, the JVM generates one automatically based on the class's structure — but that generated value changes if the class is modified later, which can break deserialization of previously saved data. Declaring it explicitly (private static final long serialVersionUID = 1L;) gives you control over compatibility across class changes.

ObjectOutputStream and ObjectInputStream

ObjectOutputStream.writeObject(obj) serializes an object to an underlying stream (typically a FileOutputStream), and ObjectInputStream.readObject() reads it back, returning an Object that must be cast to the original type. Both should be used with try-with-resources so the underlying stream is always closed properly.

Example

import java.io.*;

class Employee implements Serializable {
    private static final long serialVersionUID = 1L;

    String name;
    transient String password; // excluded from serialization

    Employee(String name, String password) {
        this.name = name;
        this.password = password;
    }
}

public class SerializationDemo {
    public static void main(String[] args) throws IOException, ClassNotFoundException {
        Employee emp = new Employee("Asha", "secret123");

        try (ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("emp.ser"))) {
            out.writeObject(emp);
        }

        try (ObjectInputStream in = new ObjectInputStream(new FileInputStream("emp.ser"))) {
            Employee restored = (Employee) in.readObject();
            System.out.println("Name: " + restored.name);
            System.out.println("Password: " + restored.password);
        }
    }
}

Name: Asha
Password: null

Exercise

The program fails with NotSerializableException because a Customer holds an Address that cannot be serialized. Change the classes so the whole object can be saved and restored, and give Customer an explicit serialVersionUID.

Expected output: Asha, Pune

import java.io.*;

class Address {
    String city;

    Address(String city) {
        this.city = city;
    }
}

class Customer implements Serializable {
    String name;
    Address address;

    Customer(String name, Address address) {
        this.name = name;
        this.address = address;
    }
}

public class SaveCustomer {
    public static void main(String[] args) throws Exception {
        Customer original = new Customer("Asha", new Address("Pune"));

        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (ObjectOutputStream out = new ObjectOutputStream(bytes)) {
            out.writeObject(original);
        }

        Customer restored;
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes.toByteArray()))) {
            restored = (Customer) in.readObject();
        }

        System.out.println(restored.name + ", " + restored.address.city);
    }
}

import java.io.*;

class Address implements Serializable {
    private static final long serialVersionUID = 1L;
    String city;

    Address(String city) {
        this.city = city;
    }
}

class Customer implements Serializable {
    private static final long serialVersionUID = 1L;
    String name;
    Address address;

    Customer(String name, Address address) {
        this.name = name;
        this.address = address;
    }
}

public class SaveCustomer {
    public static void main(String[] args) throws Exception {
        Customer original = new Customer("Asha", new Address("Pune"));

        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (ObjectOutputStream out = new ObjectOutputStream(bytes)) {
            out.writeObject(original);
        }

        Customer restored;
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes.toByteArray()))) {
            restored = (Customer) in.readObject();
        }

        System.out.println(restored.name + ", " + restored.address.city); // Asha, Pune
    }
}

Quick quiz

Interview questions