What is the SER file format?
A .ser file contains a Java serialized object stream - a binary encoding of one or more Java objects produced by ObjectOutputStream and read back by ObjectInputStream. The format was introduced with Java 1.1 in 1997 and is defined in the Java Object Serialization Specification.
Every valid .ser file begins with the 4-byte magic sequence AC ED 00 05: bytes 0-1 hold STREAM_MAGIC (0xACED) and bytes 2-3 hold STREAM_VERSION (0x0005). The stream encodes each object's class descriptor, fields, and nested data using typed block markers: TC_OBJECT (0x73), TC_CLASS (0x76), TC_ARRAY (0x75), TC_STRING (0x74), and TC_NULL (0x70).
Serialization was widely used for caching application state, passing objects between JVMs, and persisting configuration data. However, Java deserialization is a known security vulnerability - maliciously crafted streams can exploit gadget chains in the classpath to achieve remote code execution. Java 9 introduced ObjectInputFilter to restrict which classes may be deserialized, and modern Java guidance strongly discourages using .ser files for untrusted data.
Preferred modern alternatives include JSON (via Jackson or Gson), Protocol Buffers, or Kryo. GeneMapper (Thermo Fisher Scientific) uses .ser files for bioinformatics project data. The SerializationDumper utility can inspect .ser contents without executing them.
Security & safety
RISK: HIGHJava deserialization is one of the highest-severity attack surfaces in Java applications (OWASP Top 10 historically). Opening an untrusted .ser file in a vulnerable application can execute arbitrary code via gadget chains (cf. Apache Commons Collections exploit, 2015). End-users should only open .ser files from trusted sources and in their intended application. Analysing unknown .ser files: use SerializationDumper (static dump, does not execute the payload) rather than deserializing them in a live JVM.
Format details
in a nutshell- GeneMapper Project File - Applied Biosystems/Life Technologies GeneMapper software uses .ser as its proprietary project-data container.
- Generic application data cache - Any Java application can serialize arbitrary objects to .ser; contents are entirely application-specific.
Programs that open SER files
Windows2 apps
GeneMapper (Thermo Fisher Scientific)
Paid Open GeneMapper, use File > Open Project and select the .ser project file.
SerializationDumper
Open-source java -jar SerializationDumper.jar < input.ser - dumps the raw serialization stream structure for analysis. 
macOS1 app
Linux1 app
Technical details
deep spec| Magic bytes | AC ED 00 05 at offset 0 - STREAM_MAGIC (0xACED) followed by STREAM_VERSION (0x0005) |
| Encoding | Binary, big-endian |
| MIME type | application/x-java-serialized-object |
| Serialization API | java.io.ObjectOutputStream (write) / java.io.ObjectInputStream (read); classes must implement java.io.Serializable |
| Protocol version | Serialization protocol version 2 (stream version 5), stable since Java 1.2 |
| Class versioning | Each class embeds a serialVersionUID; version mismatch throws InvalidClassException at deserialization time |
| Content markers | TC_OBJECT (0x73), TC_CLASS (0x76), TC_ARRAY (0x75), TC_STRING (0x74), TC_NULL (0x70) |
| Security risk | Known deserialization gadget-chain attack vector; Java 9+ mitigates via ObjectInputFilter class-allowlisting |
| Typical size | A few bytes for simple objects up to hundreds of MB for large serialized object graphs |
| Platform portability | Readable by any JVM on Windows, Linux, or macOS; not portable outside the Java ecosystem |
| Stream compression | Uncompressed at the format level; GZIPOutputStream wrapping is optionally applied at the application layer |
| Integrity | No built-in checksum; integrity is provided by application-layer signing or secure transport |
| Known application | GeneMapper (Thermo Fisher Scientific) uses .ser for bioinformatics project and data files |
| Released | 1997 (Java 1.1, JDK 1.1) |
| Latest version | Stream version 5 (serialization protocol version 2, since Java 1.2) |
| Open standard | Yes · royalty-free |
| Specification | docs.oracle.com |
SER conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about SER files.
