5 Reasons Your IonCube Decode Failed (And How to Fix Each One)

You uploaded an IonCube file, hit decode, and got an error. Don't give up yet. Five things cause most failures, and most take under a minute to sort out.

1. Unsupported PHP version

Error: "PHP X.X is not supported yet"

Every IonCube file is compiled for a specific PHP version. The decoder reads that version from the header and checks it against what we support.

Supported right now: PHP 7.1, 7.2, 7.3, 7.4, 8.1, 8.2, 8.3, 8.4

Not supported: PHP 5.x, 7.0, 8.0

Fix: A file encoded for PHP 5.x or 7.0 was built for an older runtime with a different opcode format. We may add legacy versions later. Ping us on Signal at sologhoul.83 if you want to know where that stands.

PHP 8.0 is a quirk. IonCube never shipped a production loader for 8.0, so files encoded specifically for it are very rare. If you hit this, double-check the file really is 8.0 and not a neighbouring version.

2. The file isn't IonCube-encoded

Error: "This file does not appear to be IonCube encoded"

The decoder looks for IonCube markers in the header. If they aren't there, the file might be:

• Encoded with something else. SourceGuardian, Zend Guard and phpBolt all produce encrypted PHP that looks similar but uses a completely different format. The header gives it away:
  • IonCube: <?php //00... with an IonCube Loader check
  • SourceGuardian: <?php $sg_... or a sg_load call
  • Zend Guard: references to Zend Optimizer
• Already decoded. You might be looking at output someone already produced.
• Corrupted in transfer. FTP in ASCII mode mangles the binary data in encoded files. Re-download in binary mode.
• A wrapper. Some apps use a plain PHP file that loads the real encoded one. Look for an include or require pointing elsewhere.

Fix: Open the file and read the first few lines. The header tells you which encoder made it. We only handle IonCube here.

3. Callback encryption didn't resolve

Error: The decode succeeds, but some functions come back with empty bodies or placeholder code.

From IonCube 12 on, files can use callback-based encryption: function bodies stay encrypted until a key derived from a callback unlocks them at runtime. The decoder has to resolve that callback to give you the full output.

We attempt callback key recovery automatically, but every so often the callback is too tangled to resolve on its own.

Fix: Hit the re-decompile button on the result page. Each attempt tries a different recovery strategy, and you get up to three per file. If all three come up short, send support the file hash. That pattern may need a decoder update.

4. The file is too large

Error: "File too large. Maximum size is 10MB"

We accept files up to 10 MB. Almost every IonCube file sits comfortably under that, but the odd generated file (a concatenated build, or one with large embedded data) goes over.

Fix: Check whether the file was bundled unnecessarily. Build tools sometimes glue several PHP files into one. If it genuinely needs to be bigger than 10 MB, get in touch and we'll work something out.

5. It times out

Error: The status sits on "pending" past 60 seconds, or you get a timeout.

Most files finish in under 30 seconds. Timeouts usually mean one of:

• unusually gnarly control flow (deeply nested loops, very long functions),
• callback key recovery working through a lot of candidate keys,
• heavy server load, which is rare.

Fix: Give it a minute and refresh. It often finished after the timeout fired. If it's still "pending," upload again. Load spikes pass quickly.

Still stuck?

If none of that fits:

1. Message us on Signal at sologhoul.83.
2. Email support@decodephp.io with the error and the IonCube/PHP version that was detected.
3. Re-try the free preview at decodephp.io. Even if a decode failed before, a fresh upload can work once the decoder has been updated.

We update the decoder constantly for new IonCube versions and edge cases. A file that fails today can go through after the next update.