Java Serialization Basics
Implement Serializable, write objects to streams with ObjectOutputStream, and read them back.
Java Serialization Basics is a free Java Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Java Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Java Serialization?
Serialization converts an object's state into a byte stream so it can be saved to disk, sent over a network, or stored in a database. Deserialization reverses the process.
The Serializable Marker Interface
To serialize a class, implement java.io.Serializable. It has no methods — it signals to the JVM that instances of this class can be serialized.
import java.io.Serializable;
public class User implements Serializable {
private String name;
private int age;
public User(String name, int age) {
this.name = name;
this.age = age;
}
@Override public String toString() { return name + " / " + age; }
}Writing an Object with ObjectOutputStream
Wrap a FileOutputStream in an ObjectOutputStream and call writeObject() to serialize.
import java.io.*;
try (ObjectOutputStream oos = new ObjectOutputStream(
new FileOutputStream("user.ser"))) {
oos.writeObject(new User("Alice", 30));
System.out.println("Serialized successfully");
}Reading an Object with ObjectInputStream
Wrap a FileInputStream in an ObjectInputStream and call readObject() to deserialize. Cast the result to the expected type.
import java.io.*;
try (ObjectInputStream ois = new ObjectInputStream(
new FileInputStream("user.ser"))) {
User u = (User) ois.readObject();
System.out.println("Deserialized: " + u);
}Serializing a Graph of Objects
All objects referenced by the serialized object must also implement Serializable, or a NotSerializableException is thrown at runtime.
public class Order implements Serializable {
private User customer; // User must be Serializable
private List<String> items;
public Order(User customer, List<String> items) {
this.customer = customer;
this.items = items;
}
}NotSerializableException
If any field in the object graph is not serializable and not marked transient, Java throws NotSerializableException at write time.
// Thread is NOT Serializable
public class Task implements Serializable {
private Thread worker; // throws NotSerializableException!
// Fix: mark as transient
private transient Thread worker2;
}The Object Graph and Shared References
Java tracks object identity during serialization. If two fields reference the same object, only one copy is written, and both fields point to the same deserialized instance.
Serializing Collections
Standard collections like ArrayList, HashMap, and LinkedList already implement Serializable, so they serialize as long as their elements do.
List<String> names = new ArrayList<>(List.of("Alice", "Bob"));
try (ObjectOutputStream oos = new ObjectOutputStream(
new FileOutputStream("names.ser"))) {
oos.writeObject(names);
}Inheritance and Serialization
If a superclass is Serializable, all subclasses are also serializable. If the superclass is NOT serializable, the superclass fields are not saved; the superclass must have a no-arg constructor for deserialization.
Verifying the Byte Stream
The serialized byte stream starts with the magic bytes 0xACED 0x0005. You can inspect it with a hex editor or decode it with SerialVer tools to understand the format.
Security Warning
Java deserialization is a known attack vector. Never deserialize data from untrusted sources without validation. Prefer JSON, Protobuf, or signed envelopes for external data.
Quick Check
Which method serializes an object to a stream?
Recap
Java serialization uses ObjectOutputStream / ObjectInputStream. Classes must implement Serializable. Avoid serializing untrusted data — prefer modern alternatives for new code.
Frequently asked questions
Is the “Java Serialization Basics” lesson free?
Yes — the full text of “Java Serialization Basics” is free to read here on the web, and the Java Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Java Academy course, upgrade to CoddyKit PRO.
What will I learn in “Java Serialization Basics”?
Implement Serializable, write objects to streams with ObjectOutputStream, and read them back. You practise Java Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Java Academy?
No prior experience is required. Java Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Java Serialization Basics” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Java Academy lesson?
Yes. Every Java Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.