JSON (JavaScript Object Notation)
JSON is a lightweight, language-independent text format for structured data made of objects, arrays, strings, numbers, booleans and null. It is specified by RFC 8259 and ECMA-404 and is the default data format of web APIs.
The whole format on one screen
{
"name": "Ada Lovelace",
"age": 36,
"admin": false,
"tags": ["math", "poetry"],
"address": null
}
A JSON value is one of: an object ({...} with string keys), an array ([...]), a string, a number, true, false or null. That is all of it.
What JSON does not allow
Most “invalid JSON” errors come from writing JavaScript instead:
- Trailing commas:
{"a": 1,}is invalid. - Single quotes: strings and keys need double quotes.
- Unquoted keys:
{a: 1}is a JavaScript object, not JSON. - Comments: neither
//nor/* */is permitted. undefined,NaNandInfinity: none of them exist in JSON.
Error messages differ between engines, but a complaint about an unexpected token near the end usually means a trailing comma, and an “unexpected end” message usually means the text was cut off.
Numbers and precision
JSON has one number type and puts no limit on size, but most parsers, including JavaScript’s, read numbers as 64-bit floating point. Integers above 9,007,199,254,740,991 (2⁵³ − 1) silently lose precision. IDs that large, such as some 64-bit database keys, should be sent as strings.
Encoding and duplicates
- JSON exchanged between systems must be UTF-8. A byte-order mark should not be added, and some parsers reject one.
- RFC 8259 says object keys should be unique, but does not require it. When a key repeats, parsers disagree. JavaScript keeps the last value, others keep the first, and some raise an error. Avoid relying on either behavior.
Related formats
- JSON Lines / NDJSON: one JSON value per line, handy for logs and streaming.
- JSONC and JSON5: supersets that allow comments and trailing commas. They are used in config files, but are not valid JSON and standard parsers reject them.
- Minified versus pretty-printed: the same data with whitespace removed or added. Minifying saves bytes, and pretty-printing is easier to read. The two are equivalent to a parser.
Common pitfalls
- Parsing untrusted input without a size limit. Very large or deeply nested documents can exhaust memory.
- Assuming key order. Objects are unordered by the spec, so do not rely on the order keys appear in.
- Dates. JSON has no date type. The usual convention is an ISO 8601 string or a Unix timestamp, and both sides must agree.
- Binary data. It has to be text-encoded first, typically as Base64.
Related terms
- JWT (JSON Web Token) — A JSON Web Token is a compact, URL-safe string that carries a set of claims as JSON, usually signed so the receiver can detect tampering. It is defined in RFC 7519 and is widely used for API and session authentication.
- Base64URL — Base64URL is a variant of Base64 that swaps the characters "+" and "/" for "-" and "_" and usually drops the "=" padding, so encoded bytes can sit safely inside URLs, filenames and JWTs. It is defined in RFC 4648, section 5.
References
Ads on this page
Non-personalized ads help keep Vaultools free — Google decides where they appear on the page.
Go Pro to remove them →