How to Decode IonCube Encrypted PHP Files (2026 Guide)

You have an IonCube-encoded PHP file. Maybe you inherited a legacy codebase, need to migrate a server, or want to audit a plugin before running it in production. Whatever the reason, you need the source code back.

This guide walks through exactly how to decode IonCube encrypted PHP files using DecodePHP, with support for IonCube 10 through 15 and PHP 7.1 through 8.4.

What is IonCube encoding?

IonCube is a PHP encoder that compiles PHP source code into bytecode, then encrypts it. The resulting file requires the IonCube Loader extension to execute but cannot be read by humans. The original source code—class names, function logic, comments—is hidden behind a binary blob at the top of the file.

An encoded file typically looks like this:

<?php //0068a
// IonCube Encoder v15.0
if(!extension_loaded('ionCube Loader')){...}
// binary data follows
?>

The comment line tells you the IonCube version and the PHP version the file was encoded for. This matters because different versions use different bytecode formats.

What you need

• The .php file you want to decode (up to 10 MB)
• A web browser
• That's it. No software to install, no CLI tools, no PHP extensions.

Step 1: Upload your file

Go to decodephp.io and drag your encrypted PHP file onto the upload area. The decoder will automatically detect:

• The IonCube encoder version (10, 11, 12, 13, 14, or 15)
• The PHP version the file was compiled for (7.1, 7.2, 7.3, 7.4, 8.1, 8.2, 8.3, or 8.4)

If the file is not IonCube-encoded, the decoder will tell you immediately. No charge, no credit consumed.

Step 2: Preview the decoded output

Within seconds, you'll see the first 20 lines of the decoded source code. This preview is free and requires no account.

The preview lets you verify the decode quality before spending anything. You can check whether the class structure, function names, and logic look correct.

If the file uses callback-based encryption (common in IonCube 12+), the decoder will automatically attempt key recovery. This is handled transparently—you don't need to do anything special.

Step 3: Download the full file

If the preview looks good, create an account (takes 5 seconds—just a 16-digit number, no email required) and purchase credits to download the complete decoded file.

Pricing is straightforward:

Plan	Price	Best for
Starter	$9 (3 credits)	One-off decodes
Pro	$39 (30 credits)	Developer batches
Enterprise	$149 (150 credits)	Teams and agencies

Pack credits do not expire. All self-serve packs pay with cryptocurrency (Bitcoin, Ethereum, Litecoin, Monero, or USDT).

Supported versions

DecodePHP currently supports the following combinations:

IonCube versions

• IonCube 10 (legacy, widely deployed)
• IonCube 11
• IonCube 12 (introduced callback encryption)
• IonCube 13
• IonCube 14
• IonCube 15 (latest release)

PHP versions

• PHP 7.1, 7.2, 7.3, 7.4
• PHP 8.1, 8.2, 8.3, 8.4

Note: PHP 8.0 is not listed because IonCube never released a loader for PHP 8.0. Files encoded for PHP 8.0 are extremely rare.

What the decoded output looks like

The decoder lifts Zend opcodes back to readable PHP. The output is functionally identical to the original source code, with proper class structures, method bodies, control flow, and string literals preserved.

Some differences from the original are expected:

• Comments are not preserved (they are stripped during encoding)
• Variable names in some IonCube versions may be replaced with generated names
• Formatting may differ from the original code style
• Short closures and some PHP 8+ syntax may be expanded to their verbose equivalents

The decoded file runs correctly as a drop-in replacement. If you encounter an output issue, you can re-decompile up to 3 times per file, and our decoder will attempt alternative recovery strategies.

Common use cases

Server migration

Moving to a new PHP version but your encoded files were compiled for PHP 7.2? Decode them, then run them natively on PHP 8.4 without the IonCube Loader dependency.

Legacy code maintenance

The original developer is gone, the source was never committed to version control, and all you have are encoded files on the server. Decode to recover the source and continue development.

Plugin auditing

Before running encoded third-party code in production, decode it to check for hidden behavior, backdoors, or hardcoded credentials.

License flexibility

Some software vendors go out of business but their encoded files live on. Decoding lets you maintain software that would otherwise be abandoned.

Tips for best results

1. Upload individual files, not archives. The decoder processes one .php file at a time.
2. Check the PHP version before uploading. The decoder will reject files compiled for unsupported PHP versions and tell you exactly which version was detected.
3. Use the preview to verify quality before purchasing. The first 20 lines are free.
4. Re-decompile if needed. If the output looks incomplete, use the re-decompile button (up to 3 attempts per file) to try alternative decoding strategies.
5. Large batches? Every account includes API access for automated decoding workflows.

Frequently asked questions

What if decoding fails?

You are not charged for failed decodes. Our success rate is over 99% for supported IonCube and PHP versions. If your file fails, the decoder will explain why (unsupported version, corrupted file, etc).

Is this legal?

Decoding files you own or are authorized to access is legal in most jurisdictions. Check our Terms of Service and consult a lawyer if you're unsure about your specific situation.

How fast is decoding?

Most files decode in under 30 seconds. Large files or files with complex callback encryption may take up to 60 seconds.

Do you store my files?

Decoded content is stored in your account history so you can re-download it later. You can share individual decoded files via a public link if you choose. See our Privacy Policy for full details.