Serialization in Java

What is serialization

Serialization turns an object into a stream of bytes so you can save it to a file, store it, or send it over a network. Deserialization does the reverse — rebuilding the object from those bytes. This lets an object outlive a single program run.

The Serializable interface

import java.io.Serializable;

class Student implements Serializable {
    int id;
    String name;
    Student(int id, String name) { this.id = id; this.name = name; }
}

A class must implement Serializable to be serialized. It is a marker interface — it has no methods; it just tells Java the object is allowed to be turned into bytes.

Serializing an object

import java.io.*;

Student s = new Student(1, "Aman");
ObjectOutputStream out =
    new ObjectOutputStream(new FileOutputStream("student.ser"));
out.writeObject(s);        // object -> bytes -> file
out.close();
System.out.println("Saved");

An ObjectOutputStream writes the object to a file as bytes with writeObject. The object is now stored on disk and can be restored later.

Deserializing it back

ObjectInputStream in =
    new ObjectInputStream(new FileInputStream("student.ser"));
Student s = (Student) in.readObject();   // bytes -> object
in.close();
System.out.println(s.name);

ObjectInputStream reads the bytes back and readObject rebuilds the object. You cast the result to the original type to use it again.

The transient keyword

class User implements Serializable {
    String name;
    transient String password;   // NOT saved
}

A transient field is skipped during serialization, so its value is not written to the file. Use it for sensitive data like passwords, or for values you can recompute after loading.

Common uses

• Saving state — store objects to a file to reload later.
• Networking — send objects between programs or over the internet.
• Caching — keep computed objects for reuse.

Serialization is the standard way to persist or transmit whole Java objects.

Common mistakes

• Not implementing Serializable. Causes NotSerializableException.
• Forgetting to close streams. Close them, or use try-with-resources.
• Wrong cast on readObject. Cast to the exact original type.
• Serializing sensitive data. Mark passwords and secrets transient.

Summary

• Serialization turns an object into bytes to save or send.
• Deserialization rebuilds the object from those bytes.
• The class must implement the marker interface Serializable.
• Use ObjectOutputStream/ObjectInputStream to write/read.
• Mark fields transient to skip them during serialization.

Next, handle file and I/O errors safely with Java exception handling, or manage memory with garbage collection.