How to prevent serialization in Java?

The transient keyword is used to indicate that a field should not be serialized.

import java.io.Serializable;

public class User implements Serializable {
    private String username;
    private transient String password; // transient field - will not be serialized

    public User(String username, String password) {
        this.username = username;
        this.password = password;
    }

    // getters and setters
}

To customize serialization, implement writeObject and readObject methods with your logic to exclude certain fields.

import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;

public class SensitiveData implements Serializable {
    private String importantInfo;
    private String sensitiveInfo; // field we do not want to serialize

    public SensitiveData(String importantInfo, String sensitiveInfo) {
        this.importantInfo = importantInfo;
        this.sensitiveInfo = sensitiveInfo;
    }

    private void writeObject(ObjectOutputStream out) throws IOException {
        out.defaultWriteObject(); // serialize non-transient fields
        // do not serialize sensitiveInfo
    }

    private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject(); // deserialize non-transient fields
        // sensitiveInfo will be null after deserialization if not serialized
    }

    // getters and setters
}

Alternatively, make the class not implement Serializable or make the data fields non-serializable. If the object contains non-serializable fields, serialization will fail unless handled explicitly.

// Class does not implement Serializable - cannot be serialized
public class NonSerializableObject {
    private String data;

    public NonSerializableObject(String data) {
        this.data = data;
    }
}

import java.io.Serializable;

public class ContainsNonSerializable implements Serializable {
    private String name;
    private NonSerializableObject item; // non-serializable field

    public ContainsNonSerializable(String name, NonSerializableObject item) {
        this.name = name;
        this.item = item; // This will throw NotSerializableException if attempted to serialize
    }

    // getters and setters
}