IonCube 13 Decoder
Online

IonCube 13 — technical deep dive

Release era

2021 – 2022 (first PHP 8 support)

PHP targets

PHP 7.1 through 8.1 — the first IonCube release with PHP 8.0 and 8.1 bytecode support.

File signature

An IonCube 13-encoded PHP file opens with a header that looks like:

<?php //004fb3a4\n<?php //PHP80+
HR+cPkX...

Encryption scheme

IonCube 13 maintained the 12-series dynamic-key scheme but added a PHP-8-specific variant that handles the new Zend Engine 4 serialization format. A single Loader build switches between 7.x and 8.x codepaths based on runtime PHP version.

Obfuscation techniques IonCube 13 uses

• Enum declaration obfuscation (new opcodes, enum cases encrypted alongside string constants)
• Readonly property flag obfuscation — the readonly bit is reassembled from multiple header fields
• Match-expression arms compiled to jump tables with obfuscated indices

Anti-tamper

Enhanced dynamic-key derivation now incorporates the PHP runtime version, which prevents downgrade attacks where an attacker tries to decode an 8.1 file using a 7.4 decoder.

Where this version sits in the IonCube timeline

First release with PHP 8 support. Succeeded by IonCube 14 which added 8.2/8.3 parity.

Where you typically see IonCube 13 files

• Commercial PHP scripts migrating from 7.4 to 8.1 in 2022
• New WordPress plugins targeting PHP 8 exclusively
• Enterprise PHP modernization projects that re-encoded from IonCube 12 to 13

Decoding IonCube 13

DecodePHP sends recognized IonCube 13 files to the Phoenix decoder in an isolated microVM and lifts recovered opcodes to readable PHP. Some files require a matching license, an ordinary companion file, or callback implementation and runtime context. Eligible files get a free 20-line preview. Charged callback-key recovery may use our configured third-party model provider and reports a blocker unless it produces a complete result with no protected sections left.