---
id: "java_serialized_base64"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["software"]
langs: ["common"]
quality: 70
url: "https://registry.apicrafter.io/datatype/java_serialized_base64"
---

# Java serialized object (Base64) (`java_serialized_base64`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Java object serialization stream encoded in Base64. Every stream starts with the magic number 0xACED and the version 5, so its Base64 form starts with rO0AB. Such values in cookies, parameters or files can lead to insecure deserialization.

- Personal data (PII): no
- Categories: Software development (software)
- Countries: global
- Languages: Common to most languages (common)

## Detection

Regular expression (Python `re`):

```
^rO0AB[A-Za-z0-9+/]*={0,2}$
```

## Examples

- `rO0A` (invalid example) — Shorter than the stream header

## Supported by tools

- `pywhat`

## Sources

- doc: <https://docs.oracle.com/en/java/javase/21/docs/specs/serialization/protocol.html>

## Quality

Score 70/100. Missing: examples, mapping (Wikidata, Schema.org, ...), translation.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/java_serialized_base64.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/java_serialized_base64.yaml>