Serialization
Lesson 7 of 8
7Serialization: JSON, Pickle, CSV, and XML
The big pictureHow to turn a Python object in memory into a format you can save to a file or send over a network, and reconstruct it exactly as it was.
What the picture shows: A dictionary in memory cannot travel as it is; dumps turns it into text that is saved or sent, and loads turns it back into a dictionary on the other side.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Serialisation is like taking furniture apart to box and ship it, then assembling it exactly as before in the new home. Data in a program's memory is "assembled furniture"; to save it to a file or send it over the internet you turn it into ordered text (like JSON), and the other program puts it back together.
json.dumps/json.loads turn dicts and lists into text any language can read; pickle saves any Python object but is unsafe with untrusted data. csv handles tables and xml.etree hierarchical documents. Use ensure_ascii=False so Arabic text stays readable.
Required Fundamentals
| Concept | Why it matters here |
|---|---|
| File Handling (the Files lesson) | Every serialization operation ends with writing the result to a file or reading it back from one. |
| Classes & Objects (the Classes and objects lesson) | Pickle needs to understand an object's structure (its attributes) to save and restore it exactly. |
Core Concepts
Serialization turns a data structure or object living in a program's memory into a sequence of bytes or text that can be stored or transmitted. Deserialization is the reverse process: reconstructing the original object from those bytes.
| Format | Type | Readable by other languages? | When to use it |
|---|---|---|---|
| JSON | Text (human-readable) | Yes, a shared universal standard | Exchanging data between different systems, settings, APIs |
| Pickle | Binary | No, Python-only | Saving complex Python objects (custom classes) within your own system only |
| CSV | Text (simple tables) | Yes, opens in any spreadsheet program | Simple tabular data (rows and columns) |
| XML | Text (tree structure) | Yes, an older, widely-used standard | Complex hierarchical data, legacy systems that still require it |
Diagram 18, the full serialization round trip: out (serialize) and back (deserialize), with the goal that OBJ2 matches OBJ exactly.
pickle.load() on data from an untrusted source (a file from the internet, input from an anonymous user), Pickle's format can contain executable code when deserialized, and this is actually exploited as a security vulnerability. Always use JSON for untrusted data.
Four Formats, Four Original Examples
1JSON, Simple Game Settings
import json
settings = {"player_name": "Noura", "volume": 75, "difficulty": "hard"}
with open("settings.json", "w", encoding="utf-8") as f:
json.dump(settings, f, ensure_ascii=False, indent=2)
with open("settings.json", "r", encoding="utf-8") as f:
loaded = json.load(f)
print(loaded["difficulty"]) # hard — exactly the same value
2Pickle, Saving a Custom Object (a Game Save File)
import pickle
class GameSave:
"""Represents a player's progress inside a game."""
def __init__(self, level, score, inventory):
self.level = level
self.score = score
self.inventory = inventory
def serialize(self, filename):
with open(filename, "wb") as f:
pickle.dump(self, f)
@classmethod
def deserialize(cls, filename):
with open(filename, "rb") as f:
return pickle.load(f)
save = GameSave(level=7, score=3200, inventory=["shield", "golden key"])
save.serialize("save1.pkl")
restored = GameSave.deserialize("save1.pkl")
print(restored.level, restored.inventory) # 7 ['shield', 'golden key']
Notice that pickle.load() never needed you to tell it which class to rebuild, because Pickle stores, alongside the data itself, a reference to the class's name and module plus a snapshot of the object's __dict__, so it automatically imports the class on restore and rebuilds a new object with the exact same state. This is precisely the source of the security risk mentioned above: restoring Pickle data means executing import and object-construction code with full trust in whatever it contains.
3CSV to JSON, Converting a Scoreboard
import csv
import json
## scores.csv contains: name,points\nSara,88\nOmar,95
with open("scores.csv", "r", encoding="utf-8") as csv_file:
reader = csv.DictReader(csv_file)
rows = list(reader)
with open("scores.json", "w", encoding="utf-8") as json_file:
json.dump(rows, json_file, ensure_ascii=False, indent=2)
## result: [{"name": "Sara", "points": "88"}, {"name": "Omar", "points": "95"}]
4XML, Reading a Simple Inventory List
import xml.etree.ElementTree as ET
## inventory.xml:
## <inventory>
## <item name="sword" quantity="2"/>
## <item name="shield" quantity="1"/>
## </inventory>
tree = ET.parse("inventory.xml")
root = tree.getroot()
for item in root.findall("item"):
print(item.get("name"), "->", item.get("quantity"))
"wb"/"rb". JSON produces plain readable text, so the default text mode "w"/"r" is enough.
Worked example
json.dump(settings, f) writes text every language understands, while Pickle is Python-only and dangerous when it comes from a source you do not trust.Myth vs. Reality
| The myth | The reality |
|---|---|
| JSON and Pickle serve roughly the same purpose | JSON is limited to simple data types (string, number, list, dict) and can't save custom classes directly; Pickle saves almost any Python object as-is. |
| CSV is fine for any tabular data, no exceptions | CSV struggles with nested data (a list inside one cell) or text containing commas, JSON is often a better fit for complex data. |
| XML is an obsolete technology with no point learning it | Large enterprise systems (education, government, insurance) still rely heavily on XML for data exchange today. |
Where Is This Idea Actually Used?
APIs
Most web APIs send and receive data in JSON format.
Saving program progress
Saving a whole program's state (complex objects) with Pickle to resume later.
Data analysis
Converting CSV spreadsheet files to JSON for programmatic processing.
Legacy system integration
Large corporate and government systems often exchange data via XML.
Try it yourself
You want to send data to a program in another language. Which format will not do?
Pickle is a binary format of Python's own; other languages cannot read it, and opening it from an unknown source is dangerous.
Quick Review Flashcards
Check Your Understanding
1. If you wanted to send data to a web service written in another language (JavaScript, say), which format would you choose and why?
JSON, because it's a shared standard every language can read, unlike Pickle which is confined to Python only.
2. Why does Pickle need a classmethod to reconstruct the object while JSON doesn't?
Pickle automatically reconstructs the whole object, including its type and attributes. Using a classmethod here is just good code organization (a clean interface), not a technical requirement from Pickle itself.
3. What's the biggest challenge converting CSV to JSON when a column contains a semicolon-separated list of values?
CSV reads every cell as raw text by default, so you'd need extra processing (like .split(";")) to turn that text into an actual JSON list instead of leaving it as one long string.
Resources for this part
Sorted by kind: start with the official docs when you want the precise reference, or with an article or video when you want the explanation first.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Official docs3
Done with this lesson?
Sign in to save your progress.