transient Keyword in Java

When an object is serialized in Java — converted into a byte stream so it can be saved to a file, sent over a network, or stored elsewhere — the default behavior is to serialize every non-static field of that object, including all of its instance data, recursively. Most of the time that default is exactly what you want. Sometimes, though, a field genuinely should not be part of the saved representation, and that is what the transient keyword is for.

Marking a field transient tells the serialization mechanism to skip that field entirely: its value is simply not written into the byte stream, and when the object is later deserialized, that field comes back holding its type's plain default value rather than whatever it held before serialization.

Why it matters

Serialized objects are written to files, caches, session stores and message queues, where they can be read by anyone with access to that storage. A password or token left in a serialized object is a security problem. transient is the standard way to keep a field out of the saved form, and it is also what allows a class that holds a connection or a thread to be serialized at all.

Default Serialization Behavior (Without transient)

A class that implements java.io.Serializable has every one of its non-static fields written out by ObjectOutputStream when an instance is serialized, and read back by ObjectInputStream during deserialization. This works recursively — if a field is itself an object, that object must also be serializable (or also marked transient), or serialization fails at runtime with a NotSerializableException.

Why You Would Mark a Field transient

There are three common, legitimate reasons to exclude a field from serialization.

• Sensitive data — a password, security token, or API key should never be written into a serialized byte stream that might end up on disk or in transit.
• Derived or cacheable data — a field that can always be recomputed cheaply from other fields (like a cached hash code or a computed total) doesn't need to be persisted; it can simply be recalculated after deserialization.
• Fields of a non-serializable type — a field holding a Thread, a Socket, a database connection, or any other resource tied to the live JVM process makes no sense to serialize (and often can't be, throwing NotSerializableException if you try); marking it transient lets the rest of the object serialize successfully.

What Happens to a transient Field After Deserialization

A transient field is not merely "skipped and left alone" — after deserialization, it is explicitly set to its type's default value: 0 (or 0.0) for numeric primitives, false for boolean, '\u0000' for char, and null for any reference type (including String). Any code that relies on a deserialized object must account for the fact that transient fields will need to be re-initialized manually, if they are needed at all after deserialization.

Example

import java.io.*;

class UserSession implements Serializable {
    String username;
    transient String password; // deliberately excluded from serialization

    UserSession(String username, String password) {
        this.username = username;
        this.password = password;
    }
}

public class TransientDemo {
    public static void main(String[] args) throws Exception {
        UserSession original = new UserSession("asha", "SuperSecret123");
        System.out.println("Before serialization -> username: " + original.username + ", password: " + original.password);

        // Serialize to a byte array (in-memory, no file needed for this demo)
        ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
        try (ObjectOutputStream out = new ObjectOutputStream(byteStream)) {
            out.writeObject(original);
        }

        // Deserialize back into a new object
        ByteArrayInputStream inStream = new ByteArrayInputStream(byteStream.toByteArray());
        UserSession restored;
        try (ObjectInputStream in = new ObjectInputStream(inStream)) {
            restored = (UserSession) in.readObject();
        }

        System.out.println("After deserialization -> username: " + restored.username + ", password: " + restored.password);
    }
}

Before serialization -> username: asha, password: SuperSecret123
After deserialization -> username: asha, password: null

Exercise

As written, the program saves the PIN along with the owner's name and prints asha 4321. Change the Account class so the PIN is not serialized.

Expected output: asha 0

import java.io.*;

class Account implements Serializable {
    String owner;
    int pin; // TODO: keep this field out of the serialized form

    Account(String owner, int pin) {
        this.owner = owner;
        this.pin = pin;
    }
}

public class TransientPin {
    public static void main(String[] args) throws Exception {
        Account original = new Account("asha", 4321);

        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (ObjectOutputStream out = new ObjectOutputStream(bytes)) {
            out.writeObject(original);
        }

        Account restored;
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes.toByteArray()))) {
            restored = (Account) in.readObject();
        }

        System.out.println(restored.owner + " " + restored.pin);
    }
}

import java.io.*;

class Account implements Serializable {
    String owner;
    transient int pin; // not written to the byte stream

    Account(String owner, int pin) {
        this.owner = owner;
        this.pin = pin;
    }
}

public class TransientPin {
    public static void main(String[] args) throws Exception {
        Account original = new Account("asha", 4321);

        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (ObjectOutputStream out = new ObjectOutputStream(bytes)) {
            out.writeObject(original);
        }

        Account restored;
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes.toByteArray()))) {
            restored = (Account) in.readObject();
        }

        System.out.println(restored.owner + " " + restored.pin); // asha 0
    }
}

Quick quiz

Interview questions