What Is JSON? The Complete Guide to Structure, Types, Pitfalls, and Best Practices

What does JSON stand for?

JSON stands for JavaScript Object Notation. Standardized under RFC 8259 and ECMA-404, it is a lightweight, human-readable data interchange format.

Despite its name and lineage from JavaScript object literal syntax, JSON is completely language-agnostic. Nearly every major programming language in modern computing — including Python, Go, Java, Rust, C#, and PHP — provides native parsing and serialization libraries for JSON.

In the early 2000s, Douglas Crockford popularized JSON as a clean, lightweight replacement for bulky XML schemas (see our comparison in JSON vs XML). Today, JSON serves as the backbone of REST APIs, GraphQL payloads, serverless event structures, and modern software configuration files (package.json, tsconfig.json).

Basic syntax rules of JSON

A valid JSON document is strict text that follows five non-negotiable grammar rules:

1. Top-Level Envelope: The root value of a JSON document must be either an Object ({}) or an Array ([]) (though RFC 8259 also permits standalone scalar primitives).
2. Double Quotes are Mandatory: Keys and string values must use double quotes ("key": "value"). Single quotes ('key') are completely invalid in standard JSON.
3. No Trailing Commas: A comma must separate items in objects and arrays, but the final item must never have a trailing comma.
4. No Comments: Standard JSON explicitly forbids single-line (//) and multi-line (/* */) comments.
5. No Undefined or Functions: Values must conform to JSON's six defined primitive data types.

The six JSON data types

JSON supports exactly six data types. Any data structure must be composed exclusively of these six building blocks:

1. Strings

Strings must be wrapped in double quotes. Special characters must be escaped with a backslash (\):

2. Numbers

Numbers can be integers or floating-point values. Scientific exponential notation is supported:

{
  "integer": 42,
  "negative": -18,
  "float": 3.14159,
  "exponential": 1.5e10
}

Important limitation: JSON does not support NaN (Not-a-Number), Infinity, or -Infinity. If a JavaScript NaN is passed into JSON.stringify(), it silently coerces to null.

3. Booleans

Strictly lowercase: true or false. Uppercase variants like True or FALSE (common in Python) will cause parsing syntax errors.

4. Null

The literal keyword null represents the intentional absence of a value or an empty property.

5. Objects

An unordered collection of zero or more key: value pairs enclosed in curly braces:

{
  "name": "Sarah Connor",
  "role": "Lead Architect",
  "verified": true
}

6. Arrays

An ordered sequence of zero or more values enclosed in square brackets. Elements do not need to share the same data type:

[
  "text",
  100,
  true,
  null,
  { "nested": "object" },
  [1, 2, 3]
]

Advanced JSON Handling in JavaScript

Customizing JSON.stringify()

Many developers are unaware that JSON.stringify accepts three arguments: JSON.stringify(value, replacer, space):

const user = {
  id: 101,
  username: "dev_user",
  passwordHash: "secret_hash_987",
  created: new Date()
};

// Filter sensitive fields and format with 2-space indentation
const formatted = JSON.stringify(
  user,
  (key, value) => (key === "passwordHash" ? undefined : value), // replacer
  2 // space
);

console.log(formatted);

The BigInt Serialization Problem

Modern JavaScript supports arbitrary-precision integers with BigInt (e.g. 12345678901234567890n). However, native JSON has no concept of 64-bit or 128-bit integers.

Attempting to run JSON.stringify({ id: 12345678901234567890n }) will immediately throw a runtime error:

TypeError: Do not know how to serialize a BigInt

How to solve it: Define a global .toJSON() serialization method:

BigInt.prototype.toJSON = function () {
  return this.toString(); // Serialize BigInt as a string
};

JSON vs. JSONC vs. JSON5

Because strict JSON prohibits comments and unquoted keys, alternative formats have emerged for configuration files:

Security considerations: Injection and Prototype Pollution

While JSON is plain data and cannot execute code on its own, improper handling can introduce severe security vulnerabilities:

1. Never use eval() to parse JSON: In older codebases, developers parsed JSON using eval("(" + jsonString + ")"). This allows malicious actors to inject arbitrary executable JavaScript. Always use standard JSON.parse().
2. Prototype Pollution: When merging deeply nested JSON payloads into JavaScript objects, watch out for malicious keys such as "__proto__" or "constructor.prototype". An attacker can manipulate default object behaviors across your entire application runtime.

Frequently Asked Questions

Can JSON have date objects?

No. JSON does not define a native date type. The universal industry convention is to encode dates as ISO-8601 strings (e.g. "2026-10-06T15:30:00Z"), which can be converted using new Date(dateString) upon arrival.

What is the maximum file size for a JSON payload?

The JSON specification places no limit on document size. In practice, limitations depend on browser memory buffers and server payload limits (such as Node.js body-parser limits, usually default to 100KB or 1MB unless explicitly increased).

What is the difference between formatted and minified JSON?

• Formatted JSON contains line breaks and indentations (typically 2 or 4 spaces) for human readability.
• Minified JSON strips all non-essential whitespace, reducing file transfer size over networks by up to 30% without changing the underlying data.

Recommended Tools for Working with JSON

• JSON Formatter: Format messy or minified JSON payloads with configurable indentation and instant copy.
• JSON Validator: Catch subtle syntax errors, mismatched brackets, and illegal trailing commas instantly.
• JSON Minifier: Compress JSON payloads into a single clean line for maximum network transmission efficiency.