How to Decode IonCube Encrypted PHP Files (2026 Guide)

You've got an IonCube-encoded PHP file. Maybe you inherited a legacy codebase, you're migrating a server, or you want to audit a plugin before it runs in production. Either way, you need the source back.

This guide walks through how to decode IonCube files with DecodePHP, covering IonCube 10 through 15 and PHP 7.1 through 8.4.

What IonCube encoding is

IonCube compiles your PHP into bytecode and then encrypts it. The result needs the IonCube Loader extension to run, and a human can't read it. The original source (class names, logic, comments) sits behind a binary blob at the top of the file.

An encoded file usually looks something like this:

<?php //0068a
// IonCube Encoder v15.0
if(!extension_loaded('ionCube Loader')){...}
// binary data follows
?>

That comment line tells you the IonCube version and the PHP version the file was built for. It matters, because different versions use different bytecode formats.

What you need

• The .php file you want to decode (up to 10 MB)
• A web browser
• That's it. Nothing to install, no CLI tools, no PHP extensions.

Step 1: Upload the file

Head to decodephp.io and drag your encrypted PHP file onto the upload area. The decoder works out two things on its own:

• the IonCube encoder version (10, 11, 12, 13, 14, or 15),
• the PHP version the file was compiled for (7.1, 7.2, 7.3, 7.4, 8.1, 8.2, 8.3, or 8.4).

If the file isn't IonCube-encoded, it tells you right away. No charge, no credit used.

Step 2: Preview the output

Within a few seconds you'll see the first 20 lines of decoded source. The preview is free and needs no account.

It's there so you can judge the decode quality before spending anything: check that the class structure, function names and logic look right.

If the file uses callback-based encryption (common from IonCube 12 on), the decoder attempts key recovery on its own. That happens behind the scenes, so there's nothing extra for you to do.

Step 3: Download the full file

If the preview looks good, create an account (about five seconds: a 16-digit number, no email) and buy credits to download the complete decoded file.

The pricing is simple:

Plan	Price	Best for
Starter	$19 (3 credits)	One-off decodes
Pro	$59 (30 credits)	Developer batches
Enterprise	$199 (150 credits)	Teams and agencies

Pack credits don't expire, and every self-serve pack is paid in crypto (Bitcoin, Ethereum, Litecoin, Monero, or USDT).

Supported versions

Right now DecodePHP handles these combinations:

IonCube versions

• IonCube 10 (old, but everywhere)
• IonCube 11
• IonCube 12 (introduced callback encryption)
• IonCube 13
• IonCube 14
• IonCube 15 (latest)

PHP versions

• PHP 7.1, 7.2, 7.3, 7.4
• PHP 8.1, 8.2, 8.3, 8.4

PHP 8.0 isn't on the list because IonCube never shipped a loader for it, so files encoded for 8.0 are very rare.

What the decoded output looks like

The decoder lifts Zend opcodes back into readable PHP. The result is functionally identical to the original, with the class structures, method bodies, control flow and string literals intact.

A few differences from the original are normal:

• Comments are gone, since encoding strips them.
• Variable names may be regenerated on some IonCube versions.
• Formatting won't match your original code style.
• Short closures and some PHP 8+ syntax may come back in their longer form.

The decoded file works as a drop-in replacement. If something looks off, you can re-decompile up to three times per file, and the decoder tries different recovery strategies each time.

Common reasons people do this

Server migration

Moving to a newer PHP version, but your encoded files were built for 7.2? Decode them and run them natively on 8.4, with no IonCube Loader to worry about.

Legacy maintenance

The original developer is gone, the source was never in version control, and all that's left are encoded files on the server. Decode them and pick development back up.

Auditing a plugin

Before you run third-party encoded code in production, decode it and check for hidden behaviour, backdoors, or hardcoded credentials.

Keeping abandoned software alive

Vendors go out of business, but their encoded files keep running. Decoding lets you maintain software that would otherwise be stuck.

Tips for a clean result

1. Upload individual files, not archives. The decoder takes one .php file at a time.
2. Know the PHP version first. The decoder rejects unsupported versions and tells you exactly which one it detected.
3. Use the preview to check quality before you buy. The first 20 lines cost nothing.
4. Re-decompile if it looks thin. The re-decompile button (up to three tries per file) runs alternative strategies.
5. Big batch? Every account comes with API access for automated workflows.

FAQ

What if a decode fails?

You aren't charged for failures. The success rate is over 99% on supported IonCube and PHP versions, and when something does fail the decoder tells you why (unsupported version, corrupted file, and so on).

Is this legal?

Decoding files you own or are authorized to access is legal in most places. Read our Terms of Service, and talk to a lawyer if your situation isn't clear-cut.

How fast is it?

Most files are done in under 30 seconds. Large files, or ones with heavy callback encryption, can take up to a minute.

Do you keep my files?

Decoded output is saved in your account history so you can grab it again later, and you can share individual files via a public link if you want to. Our Privacy Policy has the full details.