5 Reasons Your IonCube Decode Failed (And How to Fix Each One)

You uploaded an IonCube file, hit decode, and got an error. These five checks explain the most common blockers and what information the service needs next.

1. Unsupported PHP version

Error: "PHP X.X is not supported yet"

Every IonCube file is compiled for a specific PHP version. The decoder reads that version from the header and checks it against what we support.

Supported ionCube targets: PHP 5.0–5.6, 7.1–7.4, and 8.1–8.4

Not supported for ionCube: PHP 7.0 and 8.0

Fix: Confirm the detected target. PHP 5.x ionCube files are accepted, but PHP 7.0 and 8.0 ionCube targets are not. SourceGuardian has a separate allowlist that includes PHP 8.0.

PHP 8.0 is a quirk. IonCube never shipped a production loader for 8.0, so files encoded specifically for it are very rare. If you hit this, double-check the file really is 8.0 and not a neighbouring version.

2. The file isn't IonCube-encoded

Error: "This file does not appear to be IonCube encoded"

The decoder looks for IonCube markers in the header. If they aren't there, the file might be:

• Encoded with something else. SourceGuardian, Zend Guard and phpBolt all produce encrypted PHP that looks similar but uses a completely different format. The header gives it away:
  • IonCube: <?php //00... with an IonCube Loader check
  • SourceGuardian: <?php $sg_... or a sg_load call
  • Zend Guard: references to Zend Optimizer
• Already decoded. You might be looking at output someone already produced.
• Corrupted in transfer. FTP in ASCII mode mangles the binary data in encoded files. Re-download in binary mode.
• A wrapper. Some apps use a plain PHP file that loads the real encoded one. Look for an include or require pointing elsewhere.

Fix: Open the file and read the first few lines. The header tells you which encoder made it. We only handle IonCube here.

3. Callback encryption didn't resolve

Error: The result reports callback-key protection and asks for more context.

From IonCube 12 on, files can use callback-based encryption: function bodies stay encrypted until a key derived from a callback unlocks them at runtime. The decoder has to resolve that callback to give you the full output.

Ordinary anonymous and no-credit public previews stop here without invoking AI recovery. Charged, trusted-account, or approved trusted-partner decodes can run AI-assisted recovery, but the callback implementation or related runtime context may still be required.

Fix: Open the recovery details, add the callback implementation or runtime context requested by the blocker, then re-decompile. You get up to three re-decompile attempts per file.

4. The file is too large

Error: "File too large. Maximum size is 10MB"

We accept files up to 10 MB. Almost every IonCube file sits comfortably under that, but the odd generated file (a concatenated build, or one with large embedded data) goes over.

Fix: Check whether the file was bundled unnecessarily. Build tools sometimes glue several PHP files into one. If it genuinely needs to be bigger than 10 MB, get in touch and we'll work something out.

5. It times out

Error: The status remains pending longer than expected or ends with a timeout.

Routine files usually finish quickly, but charged callback-key recovery can take several minutes. Longer waits can mean:

• unusually gnarly control flow (deeply nested loops, very long functions),
• callback key recovery working through a lot of candidate keys,
• heavy server load, which is rare.

Fix: Keep the result page open and watch its progress messages. Retry only after the job reports a failure or timeout; submitting duplicate uploads while the first job is active can reserve another credit.

Still stuck?

If none of that fits:

1. Message us on Signal at sologhoul.83.
2. Email support@decodephp.io with the error and the IonCube/PHP version that was detected.
3. Re-try the free preview at decodephp.io. Even if a decode failed before, a fresh upload can work once the decoder has been updated.

We update the decoder constantly for new IonCube versions and edge cases. A file that fails today can go through after the next update.