Java Object Serialization: Serializable, serialVersionUID & Transient

In Java, Serialization transforms the state of an active object into a byte stream. This byte stream can be written to a disk file, cached in Redis, or transmitted across network sockets (e.g., in RMI, microservices, or distributed clustering). Deserialization performs the inverse operation: reconstituting the live object on the JVM Heap.

1. Creating a Serializable Class

import java.io.Serializable;

public class Employee implements Serializable {
    // Explicit serialVersionUID ensures version compatibility
    private static final long serialVersionUID = 1L;
    
    private int id;
    private String name;
    private double salary;
    
    // transient fields are IGNORED during serialization
    private transient String passwordHash;
    
    public Employee(int id, String name, double salary, String passwordHash) {
        this.id = id;
        this.name = name;
        this.salary = salary;
        this.passwordHash = passwordHash;
    }

    @Override
    public String toString() {
        return "Employee{id=" + id + ", name='" + name + "', salary=" + salary + 
               ", passwordHash='" + passwordHash + "'}";
    }
}

2. Serializing with ObjectOutputStream

import java.io.FileOutputStream;
import java.io.ObjectOutputStream;
import java.io.IOException;

public class SerializeDemo {
    public static void main(String[] args) {
        Employee emp = new Employee(101, "Aarav Sharma", 85000.0, "secret#SaltedPass2026");
        
        try (FileOutputStream fileOut = new FileOutputStream("employee.ser");
             ObjectOutputStream out = new ObjectOutputStream(fileOut)) {
            
            out.writeObject(emp);
            System.out.println("Employee object serialized successfully to employee.ser");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

3. Deserializing with ObjectInputStream

import java.io.FileInputStream;
import java.io.ObjectInputStream;
import java.io.IOException;

public class DeserializeDemo {
    public static void main(String[] args) {
        try (FileInputStream fileIn = new FileInputStream("employee.ser");
             ObjectInputStream in = new ObjectInputStream(fileIn)) {
            
            // Read object and cast back to Employee
            Employee emp = (Employee) in.readObject();
            System.out.println("Object Deserialized successfully:");
            System.out.println(emp);
        } catch (IOException | ClassNotFoundException e) {
            e.printStackTrace();
        }
    }
}

Object Deserialized successfully:
Employee{id=101, name='Aarav Sharma', salary=85000.0, passwordHash='null'}

What is serialVersionUID and Why Declare It?

If you do not explicitly define a serialVersionUID, the Java compiler automatically generates one based on class member signatures, interfaces, and methods. However, if you later add even a single comment or harmless method, the compiler's auto-generated hash changes, causing existing stored files to fail with:

java.io.InvalidClassException: Employee; local class incompatible: 
stream classdesc serialVersionUID = -248293..., local class serialVersionUID = 718392...

Best Practice: Always declare private static final long serialVersionUID = 1L; explicitly in every serializable class.

Rules of Java Serialization

• Static Fields: Static variables belong to the Class, not individual instances. Hence, static fields are never serialized.
• Object Graphs: If a serializable object references another object, the referenced object must also implement Serializable, otherwise a NotSerializableException is thrown.
• Constructors: During deserialization, the constructor of the serializable class is NOT executed. Only the no-arg constructor of the nearest non-serializable superclass is called.