Object Serialization in Java: A Complete Guide

Object Serialization in Java: What Is It and Why Is It Needed?

Serialization in Java is the process of converting an object's state into a byte stream for saving to a file, database, or transmitting over a network. The reverse process — restoring an object from a byte stream — is called deserialization. This technology underlies many Java frameworks: from RMI (Remote Method Invocation) to messaging systems.

In this article, we will break down how Java's built-in serialization works with practical examples and discuss best practices for its use.

How Does Serialization Work in Java?

Java provides a built-in serialization mechanism through the java.io.Serializable interface. This interface contains no methods — it is a marker interface. If a class implements Serializable, the JVM automatically allows serialization of its objects.

Two main classes from the java.io package are used for writing and reading objects:

ObjectOutputStream — serializes an object into a byte stream
ObjectInputStream — deserializes an object from a byte stream

A Simple Serialization Example

Let's create a Person class that can be serialized:

import java.io.Serializable;

public class Person implements Serializable {    private static final long serialVersionUID = 1L;    private String name;    private int age;    private transient String password; // will not be serialized

    public Person(String name, int age, String password) {        this.name = name;        this.age = age;        this.password = password;    }

    @Override    public String toString() {        return "Person{name='" + name + "', age=" + age + ", password='" + password + "'}";    }}

Now let's write the code for serialization and deserialization:

import java.io.*;

public class SerializationDemo {    public static void main(String[] args) {        Person person = new Person("Ivan", 30, "secret123");                // Serialization        try (FileOutputStream fos = new FileOutputStream("person.ser");             ObjectOutputStream oos = new ObjectOutputStream(fos)) {            oos.writeObject(person);            System.out.println("Object serialized: " + person);        } catch (IOException e) {            e.printStackTrace();        }

        // Deserialization        try (FileInputStream fis = new FileInputStream("person.ser");             ObjectInputStream ois = new ObjectInputStream(fis)) {            Person restoredPerson = (Person) ois.readObject();            System.out.println("Object restored: " + restoredPerson);        } catch (IOException | ClassNotFoundException e) {            e.printStackTrace();        }    }}

Program output:

Object serialized: Person{name='Ivan', age=30, password='secret123'}Object restored: Person{name='Ivan', age=30, password='null'}

Note: the password field was marked with the transient keyword and received the value null upon deserialization. This is the standard way to exclude confidential data from serialization.

Important Features of Serialization in Java

serialVersionUID — a unique class version identifier. If you do not declare it explicitly, the JVM will generate it automatically, but this can lead to an InvalidClassException when the class changes. It is recommended to always declare private static final long serialVersionUID.
Static fields are not serialized — they belong to the class, not the object.
Nested objects — if a serializable object contains references to other ob