How to Decode IonCube Encrypted PHP Files (2026 Guide)

You've got an IonCube-encoded PHP file. Maybe you inherited a legacy codebase, you're migrating a server, or you want to audit a plugin before it runs in production. Either way, you need the source back.

This guide covers recognized IonCube 10 through 15 builds on DecodePHP's ionCube target allowlist: PHP 5.0–5.6, 7.1–7.4, and 8.1–8.4.

What IonCube encoding is

IonCube compiles your PHP into bytecode and then encrypts it. The result needs the IonCube Loader extension to run, and a human can't read it. The original source (class names, logic, comments) sits behind a binary blob at the top of the file.

An encoded file usually looks something like this:

<?php //0068a
// IonCube Encoder v15.0
if(!extension_loaded('ionCube Loader')){...}
// binary data follows
?>

That comment line tells you the IonCube version and the PHP version the file was built for. It matters, because different versions use different bytecode formats.

What you need

• The .php file you want to decode (up to 10 MB)
• If the decoder asks for a protection file, upload the requested file from the same application
• A web browser
• For callback-key recovery, the callback implementation or related runtime context may also be required

Step 1: Upload the file

Head to decodephp.io and drag your encrypted PHP file onto the upload area. The decoder works out two things on its own:

• the IonCube encoder version (10, 11, 12, 13, 14, or 15),
• the PHP version the file was compiled for (accepted ionCube targets are PHP 5.0–5.6, 7.1–7.4, and 8.1–8.4).

If the file isn't IonCube-encoded, it tells you right away. No charge, no credit used.

Step 2: Preview the output

If the supported file completes without an unresolved protection requirement, you'll see the first 20 lines of decoded source. The preview is free and needs no account.

It's there so you can judge the decode quality before spending anything: check that the class structure, function names and logic look right.

If the file uses callback-based encryption, the ordinary public preview stops with guidance. A charged account or approved trusted-partner decode can attempt AI-assisted recovery and may request callback code or runtime context. That context and relevant decoded fragments may be sent to our configured third-party model provider.

Step 3: Download the full file

If the preview looks useful, create an account and buy credits to run the full decode. A viewable result can then be downloaded; the preview itself does not guarantee that later protected sections will complete.

The pricing is simple:

Plan	Price	Best for
Starter	$19 (3 credits)	One-off decodes
Pro	$59 (30 credits)	Developer batches
Enterprise	$199 (150 credits)	Teams and agencies

Pack credits don't expire, and every self-serve pack is paid in crypto (Bitcoin, Ethereum, Litecoin, Monero, or USDT).

Supported versions

DecodePHP accepts recognized builds from these ionCube series on the PHP target allowlist. Not every encoder/PHP cross-version pair exists or is compatible, and protection artifacts or context may still be required.

IonCube versions

• IonCube 10 (old, but everywhere)
• IonCube 11
• IonCube 12 (introduced callback encryption)
• IonCube 13
• IonCube 14
• IonCube 15

PHP versions

• PHP 5.0–5.6 and 7.1–7.4
• PHP 8.1, 8.2, 8.3, 8.4

DecodePHP does not accept ionCube files targeting PHP 7.0 or 8.0. SourceGuardian support has a separate PHP 7.1–8.4 allowlist that includes 8.0.

What the decoded output looks like

The decoder lifts Zend opcodes back into readable PHP where it can reconstruct them. Functional equivalence is not guaranteed; inspect, lint, and test the result in an isolated environment.

A few differences from the original are normal:

• Comments are gone, since encoding strips them.
• Variable names may be regenerated on some IonCube versions.
• Formatting won't match your original code style.
• Short closures and some PHP 8+ syntax may come back in their longer form.

Do not assume the recovered file is a drop-in replacement. Run php -l, your test suite, and a focused smoke test before changing a deployment.

Common reasons people do this

Server migration

Moving to a newer PHP version, but your encoded files were built for 7.2? Recover the source, modernize it for the new runtime, then lint and test it before deployment.

Legacy maintenance

The original developer is gone, the source was never in version control, and all that's left are encoded files on the server. Decode them and pick development back up.

Auditing a plugin

Before you run third-party encoded code in production, decode it and check for hidden behaviour, backdoors, or hardcoded credentials.

Keeping abandoned software alive

Vendors go out of business, but their encoded files keep running. Decoding lets you maintain software that would otherwise be stuck.

Tips for a clean result

1. Upload individual files, not archives. The decoder takes one .php file at a time.
2. Know the PHP version first. The decoder rejects unsupported versions and tells you exactly which one it detected.
3. Use the preview to check quality before you buy. The first 20 lines cost nothing.
4. Re-decompile if it looks thin. The re-decompile button (up to three tries per file) runs alternative strategies.
5. Big batch? Every account comes with API access for automated workflows.

FAQ

What if a decode fails?

An attempt that produces no viewable result does not use a credit. A viewable partial callback-key result uses one credit and reports what remains protected.

Is this legal?

Decoding files you own or are authorized to access is legal in most places. Read our Terms of Service, and talk to a lawyer if your situation isn't clear-cut.

How fast is it?

Routine files usually finish quickly. Charged callback-key recovery can take several minutes, and the page shows progress while it runs.

Do you keep my files?

Decoded output is saved in your account history so you can grab it again later, and you can share individual files via a public link if you want to. Our Privacy Policy has the full details.