kryo

Kryo turns Java objects into compact bytes and back, much faster and smaller than Java's built-in serialization. You rarely see it, but it's inside tools you do: Spark uses it for shuffled and cached data, Hive for query plans, Flink as a fallback serializer. It's free under the BSD 3-clause license.

Setup is a Maven dependency. The work is configuration. By default every class you write must be registered up front. A Kryo instance is not thread safe, so each thread needs its own or you use a pool. The default FieldSerializer stores no schema, so adding or removing a field breaks bytes you already saved; use TaggedFieldSerializer or CompatibleFieldSerializer for anything long-lived. The format assumes Java on both ends. For cross-language or long-term storage, Protobuf or Avro are the safer picks.

There's no paid tier. Solo, small teams, larger teams: free.

The catch: Kryo's own README says it is not designed to make deserializing untrusted data safe. Turn off required registration and a crafted payload can create any class on your classpath. That's how Spring Statemachine shipped a CVE rated 8.8 in June 2026. Keep registration on, and set setMaxArraySize (new in 5.7.0) when reading streams.