ionCube and SourceGuardian solve a similar distribution problem: they let publishers ship compiled, protected PHP instead of ordinary source. That similarity often causes users to treat them as interchangeable. They are not. Each product uses its own container structures, metadata, loader family, and version history.
What they have in common
- Protected files commonly retain the
.phpextension. - A platform loader executes the protected program at runtime.
- The encoded data targets particular PHP versions.
- Compilation may remove formatting, comments, and source-level choices.
- A decoder must reconstruct program structure from stored instructions.
Where the formats differ
The outer container, encryption metadata, literal encoding, declaration records, and bytecode transformations are format-specific. A SourceGuardian revision number has no meaning to an ionCube parser; an ionCube serialization profile does not describe a SourceGuardian file. This is why a combined website still needs two explicit decoder engines.
Loader clues
ionCube files normally refer to the ionCube Loader family. SourceGuardian files commonly refer to SourceGuardian or ixed loaders. Deployment documentation is often the quickest source of truth when the wrapper is minimal.
Compatibility clues
For ionCube, useful details include encoder version, PHP target, serialization profile, and bytecode features. For SourceGuardian, container revision, protection and metadata tags, PHP target, and literal or type formats matter.
Which decoder should you choose?
Choose the protector named by the wrapper or required loader. If the file identifies ionCube, use the ionCube decoder preview. If it identifies SourceGuardian, use the SourceGuardian decoder preview. If neither is present, do not guess repeatedly; the file may be ordinary PHP, truncated, or protected by another system.
An immediate “not this format” result prevents a non-ionCube or non-SourceGuardian file from entering a repair queue. It protects users from waiting for a decoder that can never process the payload.
Preview versus complete decode
A preview is a fast compatibility check. It parses the file, begins reconstruction, and returns the first 15 decoded lines. A complete decode processes every function and class, then creates a downloadable PHP file or structured ZIP. A program can pass early parsing and still contain a rare instruction later, which is why complete coverage requires the full job.
What “decoded” means
Decoded PHP is reconstructed source, not necessarily the exact text written by the original developer. Semantically equivalent syntax can look different: short arrays can include explicit numeric keys, built-in names can be fully qualified, declarations can be placed according to bytecode order, and temporary expressions can be simplified. A mature reconstructor works to produce natural PHP while preserving behavior.
Practical selection checklist
- Inspect the wrapper and loader requirement.
- Select the matching decoder page.
- Upload only a file you are authorized to inspect.
- Review the free preview.
- Use a complete decode for full functions, classes, and archives.
- Validate syntax and application behavior before deployment.