Data Serialization in Mobile Development — What It Is, Formats, and Principles of Operation

What Is Serialization?

Serialization is the process of converting an object residing in RAM into a linear sequence of bytes or characters that can be transmitted over a network, saved to a file, or passed to another process. Without serialization, network communication, state persistence, and interprocess interaction would be impossible.

Serialization involves two opposing processes. The forward process (serialization) packs data into a transmission format. The reverse process (deserialization) restores data back into an object. Deserialization is critical for security: incorrect input data can lead to vulnerabilities in the application.

In mobile application development, serialization is used everywhere: sending requests to the server and processing responses, saving application state on screen rotation, caching data on disk, and passing data between screens via Intent (Android) or Segue (iOS).

Main Tasks of Serialization

• Network communication — data transfer between client and server
• State persistence — saving and restoring application data
• Caching — storing request results for offline access
• Cross-platform — data exchange between systems in different languages
• Logging — serializing objects for writing to logs

Main Serialization Formats

Serialization formats are divided into text and binary. Text formats (JSON, XML) are human-readable and require no tools to view. Binary formats (Protobuf, FlatBuffers, MessagePack) are more compact and faster but unreadable without deserialization. Format choice is a trade-off between performance and debugging convenience.

Besides JSON, XML, and Protobuf, there are specialized formats: FlatBuffers from Google for games and AR, MessagePack — a compact binary JSON alternative, Avro from Apache for big data in Kafka, YAML — a configuration format with comment support.

Serialization in Mobile Development

Serialization on mobile platforms has its own specifics: limited traffic, weaker processors, and the need to preserve state during screen rotations. On Android, Gson, Moshi, and Kotlinx Serialization are used. On iOS — Codable, JSONSerialization, PropertyListEncoder. Choosing the right library critically affects application performance.

Kotlinx Serialization is a modern library from JetBrains for Kotlin Multiplatform Mobile. It supports JSON, Protobuf, CBOR, and custom formats. Code generation happens at compile time through the Kotlin Serialization plugin, providing high performance without using reflection.

Kotlinx Serialization (Kotlin Multiplatform)

The Kotlinx Serialization library uses the @Serializable annotation for classes and a compiler plugin to generate serializers. This ensures high performance and type safety. The default format is JSON, but other formats are supported through additional modules.

import kotlinx.serialization.Serializable
import kotlinx.serialization.json.Json
import kotlinx.serialization.encodeToString
import kotlinx.serialization.decodeFromString

@Serializable
data class Project(
    val id: Int,
    val name: String,
    val platforms: List<String>,
    val active: Boolean
)

val json = Json {
    prettyPrint = true
    ignoreUnknownKeys = true
    encodeDefaults = true
}

fun main() {
    val project = Project(1, "MobileApp",
        listOf("Android", "iOS"), true)

    // Serialization
    val jsonString = json.encodeToString(project)

    // Deserialization
    val restored = json.decodeFromString<Project>(jsonString)
}

Codable on iOS (Swift)

The Codable protocol is Swift’s built-in serialization mechanism. It combines the Encodable (serialization) and Decodable (deserialization) protocols. JSONEncoder and JSONDecoder automatically handle nested structures, arrays, optional values, and custom keys through CodingKeys.

import Foundation

struct AppConfig: Codable {
    let appName: String
    let version: String
    let features: [String]
    let isProduction: Bool
}

let config = AppConfig(
    appName: "MyApp",
    version: "2.1.0",
    features: ["push", "analytics", "offline"],
    isProduction: true
)

let encoder = JSONEncoder()
encoder.outputFormatting = [.prettyPrinted, .sortedKeys]

guard let data = try? encoder.encode(config) else { return }
let jsonString = String(data: data, encoding: .utf8)

Performance and Format Comparison

Performance of serialization formats is evaluated by three metrics: message size, serialization speed, and deserialization speed. For mobile applications, all three are critical: size affects traffic and load time, speed affects interface responsiveness and application startup time.

Protobuf and FlatBuffers show the best results thanks to binary representation. FlatBuffers stands out because it does not require a separate deserialization step — data is read directly from the binary buffer, making it ideal for games and AR applications with minimal latency requirements. JSON remains the most popular format for REST APIs, despite worse performance, due to its simplicity and universality.

Benchmark Testing

Practical tests on a dataset of 1000 user objects show: Protobuf creates messages of 12 KB (JSON — 85 KB, XML — 120 KB). Serialization time: Protobuf — 2 ms, JSON — 8 ms, XML — 25 ms. These numbers make binary formats preferable for high-load systems and mobile applications with limited traffic.

Data Serialization Examples

Examples demonstrate serialization of the same object in different formats. This helps visually compare size and readability. The same User object will be serialized in JSON, XML, and Protobuf — it is clearly visible that JSON is more compact than XML, and Protobuf is the most compact of all while being unreadable.

One Object in Three Formats

JSON — minimalist syntax, keys in quotes, values of different types. Takes 80 characters. Readability is high, visual structure is clear. Suitable for APIs where development and debugging speed matter.

XML — each element is wrapped in opening and closing tags. Takes 150 characters. Readability is moderate, structure is strict. Suitable for document workflows and systems requiring XSD validation.

Protobuf — binary, 32 bytes for this data. Unreadable — requires deserialization to view. Minimal size makes it ideal for high-load systems and mobile applications.

{
  "id": 42,
  "name": "IT Sectr",
  "email": "team@itsectr.com",
  "role": "admin",
  "active": true
}

<user>
    <id>42</id>
    <name>IT Sectr</name>
    <email>team@itsectr.com</email>
    <role>admin</role>
    <active>true</active>
</user>

Serialization Best Practices

Best practices help avoid common mistakes and choose the right serialization strategy for your project. Following these recommendations improves performance, security, and code maintainability.

Recommendations for Mobile Development

1. Choose format by scenario — JSON for REST APIs, Protobuf for gRPC and microservices
2. Avoid Java Serializable — slow and unsafe mechanism, use Kotlinx Serialization or Moshi
3. Ignore unknown keys — configure the parser to skip fields not present in the model
4. Cache deserialized data — avoid re-parsing the same data
5. Validate input data — check bounds and types during deserialization

Security and Serialization

Serialization security is a critically important aspect, especially when deserializing data from untrusted sources. Deserialization attacks can lead to remote code execution (RCE), making it one of the most dangerous vulnerabilities in web and mobile applications. The most well-known cases are related to Java Serializable and Python pickle.

Protobuf and JSON have built-in protection against such attacks because they work only with data, not with arbitrary objects. Java Serializable, on the other hand, can restore any class available in the classpath, making it dangerous for receiving data from external sources. On Android, it is recommended to use Kotlinx Serialization or Moshi instead of standard Java Serialization.

Additional security measures: set a limit on input data size, validate the schema before deserialization, do not trust Content-Type from HTTP headers, use an allowlist for permitted classes. Regularly update serialization libraries, as vulnerabilities are periodically discovered and fixed.