How it works
What actually happens to your file
This page describes the real pipeline, including where it can stop and why.
Upload and validate
You upload from the dashboard. The server reads the bytes, decides the file type from the content, and inspects archives before creating a job.
Rejected files never consume allowance.
Queue and decode
The job is stored in PostgreSQL and leased by a worker, which submits the file to the decoding provider and polls until it finishes.
The provider job reference is saved first, so a restart resumes rather than re-uploads.
Validate and deliver
The result must pass a validity check before it is stored. Then it is downloadable, with an escaped preview on the job page.
Results are deleted when the retention window ends.
Job states
Every state a job can be in
You see the same states the database records, so there is no difference between what the dashboard shows and what actually happened.
- created
- The upload is stored privately and a job row is written. Nothing has been sent anywhere yet.
- validating
- The bytes are classified. Archives are parsed and checked for traversal, symlinks, encryption and bombs.
- queued
- Quota is reserved against your pass. The job waits for a worker to lease it.
- processing
- A worker submits the file to the decoding provider, stores the provider's job reference, then polls for the result while holding a lease.
- succeeded
- The result is checked for emptiness, size and text-ness, stored privately, and offered to you for download and preview.
- failed / cancelled / expired
- A failure records a reason and returns your allowance. Cancelling stops a job before it starts. Expiry means the retention window elapsed and the files were deleted.
Honest limits
Where recovery stops
Being specific about limits is more useful than promising a result.
Reversible wrappers
base64, gzip and simple character-shuffling layers are commonly reversible, and these are the cases where recovery is most likely to produce genuinely useful output.
Commercial encoders
ionCube, SourceGuardian, Zend Guard and PHP Shield are designed so that the original source is not recoverable from the file alone. Dezender identifies these families so you know before you spend allowance.
Formatting is not authorship
Recovering a file produces readable code. It does not restore the author's comments, original variable names or layout, and it will not match any original byte for byte.
Before you buy
Common questions
What is Dezender?
Dezender is a PHP source recovery platform. You upload an encoded or obfuscated PHP file, Dezender validates it, submits it to a decoding service, and returns readable, formatted source in a dashboard you can download from. It is a finished product with accounts, a paid pass, job history and support, not a library or a command-line tool.
How does PHP source recovery work?
Protection tools usually apply a reversible transformation: base64 or gzip wrapping, a custom character-shuffling routine, or a commercial encoder. Recovery means reversing that specific transformation and then formatting the result so a human can read it. Dezender does not guess: it inspects the file, classifies what kind of wrapper it is, and sends it to a decoding pipeline that handles that family. Reversing the wrapper is not the same as recovering an author's original formatting, comments or variable names, and Dezender never claims it is.
Which file formats are supported?
Single PHP-family source files (.php, .phtml, .php3 to .php8, .inc, .module, .tpl, .ctp) and .zip archives that contain only those files. The file type is determined from the file's contents, not from its extension or the browser-reported type, and anything else is rejected before it reaches processing.
How does the Developer Pass work?
The Developer Pass is a one-time payment of €20 that gives you a 240-hour (10-day) window of access, counted from the moment the payment is verified on our servers. Inside that window you can submit files up to the pass allowance, see every job's status, and download your results. The pass is activated by a verified payment event, never by a browser redirect.
Create an account now
20 EUR once for 240 hours of access. No automatic renewal, and a full refund if no job has been submitted.