Supported file formats

Dezender accepts PHP-family source files and ZIP archives that contain only those files. The type is determined from the file's contents: renaming a binary to .php does not make it a PHP file, and a valid archive with a missing extension is still walked as bytes.

Accepted extensions:

.ctp  .inc  .module  .php  .php3  .php4  .php5  .php7  .php8  .phps  .phtml  .tpl  .zip

A single file must be valid text, must not look like an HTML document, and must contain a PHP opening tag. An archive must contain at least one file, may contain at most 200 entries, must not expand beyond 256 MB in total or 64 MB per entry, and is rejected outright if it contains an absolute path, a .. segment, a symbolic link, an encrypted entry, or a compression ratio above 200:1.

Recovery expectations

Every upload is classified before it is queued, and the classification is shown to you. It is a description of what the file looks like, not a promise: it tells you which family the pipeline will attempt.

Recovery never reconstructs an author's original comments, formatting or private variable names. What you get is readable, syntactically valid code that implements the same behaviour.

Pass limits and allowances

A single plan is sold: Developer Pass, EUR 20.00 once, granting 240 hours (10 days) of access. Every limit below is enforced in the database at the moment of use, so it cannot be changed from the browser.

Allowance spent by a job that ends in failure is returned to the pass, so a failed decode does not consume a slot.

The job lifecycle

A job moves through a fixed set of states: created → validating → queued → processing → succeeded, with failed, cancelled and expired as alternative endings. Illegal transitions are refused, so a duplicated provider callback cannot rewrite history.

• Retries. Transport failures are retried with exponential backoff up to three attempts. A contract mismatch or an unrecoverable encoding stops immediately.
• Leases. A worker holds a time-limited lease and renews it while polling. If the worker disappears, the lease expires and the job is picked up again.
• No duplicate submissions. The provider's job id is persisted before polling starts, so a retry resumes the existing upstream job.
• Validation before delivery. Empty results, oversized results, binary output and HTML error pages are rejected and the job is marked failed.

Security model

• Uploaded PHP is never executed, produced or included at any point.
• Objects are stored under random keys in private storage, never in the web root.
• Downloads and previews check ownership on the server for every request.
• Recovered source is rendered as escaped text, never as HTML.
• Passwords use scrypt with per-user salts; session tokens are stored only as hashes.
• Administrative actions are written to an audit log with actor, target and timestamp.

Troubleshooting

"That file is not PHP source"

The bytes are not text, contain null bytes, or the document is HTML. Export the real PHP file rather than a rendered page, and if the file came from a Windows editor check that it was saved in a text encoding rather than as a binary object.

"That file has no PHP opening tag"

The file looks like text but contains no PHP open tag, so there is nothing to decode. Check that you uploaded the source file rather than a configuration or template fragment that has had its tags stripped.

The job failed with an unrecoverable encoding

The file was produced by a commercial encoder whose protection is not reversible from the file alone. This is a property of the protection, not a transient fault, which is why the job is not retried. Your allowance for that job is returned.

The archive was rejected

Archives are refused for traversal paths, absolute paths, symlinks, encryption, unsupported compression, too many entries, oversized expansion, or a suspicious compression ratio. Re-create the archive from the files themselves with a standard ZIP tool.

The pass expired mid-work

The 240-hour window is absolute. Jobs already finished keep their results until the result retention window ends, but new submissions are refused. Buying another pass starts a new window.

Payments

A redirect back to the site is never proof of payment. If your bank shows a completed payment but no pass appeared, contact support with the transaction reference; a verified event will activate the pass, and a duplicate charge is refunded.

API surface

The dashboard is built on the same authenticated HTTP endpoints that are available to your account. All of them require a signed-in session and return JSON.

The payment webhook at POST /api/webhooks/payment is provider-facing: it is signature-verified and is not part of the customer API.

Glossary

• Pass. A purchased entitlement granting a fixed access window and allowance.
• Job. One uploaded file and everything that happened to it.
• Entitlement. The server-side record that decides whether a submission is allowed.
• Retention window. How long uploads and results remain stored before automatic deletion.
• Provider. The third-party service that performs the decoding.