How to Identify an ionCube Encoded PHP File

An encoded PHP file may still end in .php, but its contents and runtime behavior are different from ordinary source. Identifying the protector first matters because ionCube and SourceGuardian use different containers, metadata, loaders, and reconstruction paths. Sending a file to the wrong decoder should produce a format error rather than a useful result.

Start with the PHP wrapper

Open a copy of the file in a text editor. Many ionCube files begin with a short PHP wrapper that checks for an ionCube Loader and may print an installation message. The readable wrapper is followed by a long encoded payload. Wrapper text varies across encoder generations, so a single phrase is evidence, not a complete compatibility test.

<?php // ionCube loader wrapper … ?>
encoded payload data follows

Do not execute an unknown file just to identify it. Static inspection and a decoder preview can classify the format without running the protected application logic.

Signals that strongly suggest ionCube

A loader check or message that names the ionCube PHP Loader.
A compact readable wrapper followed by a large encoded block.
Deployment instructions that require an ioncube_loader_*.so or matching platform loader.
Metadata reported by an inspection tool, such as an encoder version, PHP target, or serialization profile.

File names and extensions do not identify the protector. A normal-looking plugin path can contain protected PHP, while another file in the same package remains ordinary source.

Why PHP version information matters

Protected bytecode targets a PHP instruction set. A file built for PHP 7.4 differs from one built for PHP 8.3, even when both came from the same original project. Encoder generation, target PHP version, serialization format, and optional protection settings all affect the container a decoder must parse.

A useful compatibility report therefore includes the exact file, detected encoder version, PHP target, serialization profile, and the first reconstruction error. “It is ionCube” alone is not enough to diagnose a difficult file.

Fastest safe check

Use the ionCube decoder preview. It accepts one PHP file and returns the first 15 reconstructed lines when the format is recognized and supported.

ionCube or SourceGuardian?

SourceGuardian files often include SourceGuardian or ixed-loader references and use their own container revisions. If static inspection points to that format, open the SourceGuardian decoder instead. AseWeb keeps the two upload paths separate so the chosen engine is explicit.

What a successful preview proves

A successful preview proves that the service recognized the file and reconstructed the beginning of its program. It does not promise that reconstructed text will match the original source character for character. Compilation can discard comments, whitespace, and some syntax choices before protection. Complete decoding checks the remaining functions, classes, control flow, and data structures.

Before submitting a file

Work on a copy and keep the original unchanged.
Confirm you own the code or have permission to inspect it.
Choose the protector shown by the wrapper or deployment documentation.
Run a free preview, then use a complete decode only when you need the full reconstructed file.