#1JSON: the parts that still trip people up

What we tested: We processed API response payloads ranging from 1 KB to 50 MB through each JSON tool on this site. Formatting, validation, and conversion times were measured in Chrome 128 with DevTools performance panel. All processing runs locally in the browser, no server round-trips.

JSON is everywhere because it is simple, but that simplicity hides a few annoying failure modes.

The practical problems that still show up in real projects are syntax mistakes, number precision, duplicate keys, and parser differences.

#21. Why JSON replaced XML in practice

To appreciate JSON's design, it helps to recall the state of web development in the early 2000s.

Before JSON, web services relied almost exclusively on XML (eXtensible Markup Language) and SOAP (Simple Object Access Protocol) for data exchange.

<!-- Example XML Data Payload -->
<?xml version="1.0" encoding="UTF-8"?>
<user id="101">
  <name>Alice Smith</name>
  <email>alice@example.com</email>
  <roles>
    <role>admin</role>
    <role>developer</role>
  </roles>
</user>

// Equivalent JSON Data Payload
{
  "id": 101,
  "name": "Alice Smith",
  "email": "alice@example.com",
  "roles": ["admin", "developer"]
}

#3The Three Architectural Advantages of JSON

1. Payload Compactness: XML requires closing tags (</name>, </role>), verbose namespaces, and attribute declarations, adding 30% to 50% extra bandwidth bloat compared to JSON.
2. Native Language Mapping: JSON maps directly to data structures native to virtually all modern languages: key-value maps (objects) and ordered lists (arrays). XML requires traversing DOM element trees or writing complex SAX parsers.
3. Native Browser Parsing: In web browsers, parsing JSON (JSON.parse()) executes inside highly optimized native C++ browser engines, whereas parsing XML required expensive DOM XML Document creation.

#22. The Six Strict JSON Data Types (RFC 8259)

RFC 8259 specifies that a valid JSON document must consist of values belonging strictly to one of six data types. No other types are supported.

┌─────────────────────────────────────────────────────────────┐
│                 THE 6 STRICT JSON DATA TYPES                │
├─────────────────┬───────────────────────────────────────────┤
│ 1. String       │ Double-quoted UTF-8 text ("hello")        │
│ 2. Number       │ Double-precision float (42, -3.14, 1e10)  │
│ 3. Object       │ Unordered key-value map ({ "k": "v" })    │
│ 4. Array        │ Ordered list of values ([ 1, "two", true])│
│ 5. Boolean      │ Literal true or false (lowercase)        │
│ 6. Null         │ Literal null (lowercase)                  │
└─────────────────┴───────────────────────────────────────────┘

#3What Is NOT Allowed in Standard JSON

• undefined: Invalid. Use null or omit the key entirely.
• Functions / Methods: Invalid. JSON is data, not code.
• Dates: No native Date type exists. Dates must be formatted as ISO 8601 strings ("2025-02-20T14:30:00Z") or Unix epoch integers.
• Comments: Standard JSON explicitly prohibits // or /* */ comments.
• Single Quotes: 'text' is invalid. Strings must use double quotes (").
• Hexadecimal / NaN / Infinity: 0xFF, NaN, and Infinity are invalid numbers.

#23. The 4 Golden Syntax Rules & Common Failure Modes

Syntax errors in JSON account for thousands of broken deployment pipelines and API failures. Always enforce these four golden syntax rules:

#3Rule 1: Double Quotes Only

Keys and string values must be enclosed in standard double quotes (").

// INVALID
{ 'name': 'Alice', status: 'active' }

// VALID
{ "name": "Alice", "status": "active" }

#3Rule 2: No Trailing Commas

Trailing commas after the final property in an object or final element in an array are strictly forbidden.

// INVALID (Trailing comma on line 3)
{
  "id": 101,
  "name": "Widget",
}

// VALID
{
  "id": 101,
  "name": "Widget"
}

#3Rule 3: Proper Escaping of Special Characters

Double quotes (\"), backslashes (\\), and control characters (\n, \t) inside string values must be escaped:

// INVALID (Unescaped quote causes parse error)
{ "message": "He said "Hello"" }

// VALID
{ "message": "He said \"Hello\"" }

#3Rule 4: UTF-8 Encoding Without BOM

RFC 8259 specifies that JSON text must be encoded in UTF-8. Byte Order Marks (BOM) at the beginning of files generated by Windows editors (like Notepad) cause parser failures in Linux environments.

#24. Floating-Point Precision Limits (The 64-Bit Integer Problem)

A major trap in JSON processing involves large integer numbers (such as 64-bit database IDs, Twitter snowflake IDs, or microsecond timestamps).

The JSON specification defines numbers as arbitrary precision, but JavaScript and many language runtimes parse JSON numbers into IEEE 754 Double-Precision Floats.

#3The Precision Loss Example

In IEEE 754 double precision, the maximum safe integer is 2^53 - 1 (9,007,199,254,740,991).

// Danger: Parsing a 64-bit integer ID in JavaScript
const jsonString = '{"user_id": 1892837465019283746}';
const parsed = JSON.parse(jsonString);

console.log(parsed.user_id); 
// Output: 1892837465019283700  <-- LAST DIGITS CORRUPTED!

The Solution: Always transmit 64-bit integers, 128-bit UUIDs, and high-precision financial numbers as String values in JSON payloads:

// SAFE: Transmit 64-bit IDs as strings
{ "user_id": "1892837465019283746" }

#3Comparison Matrix: JSON vs. JSON5 vs. JSONC vs. TOML

To address standard JSON's strict lack of comments or trailing commas in configuration files, the developer community created extended variants:

#3Streaming Large JSON Payloads (GB-Scale Processing)

Standard JSON.parse() reads the entire JSON payload string into contiguous memory before executing parsing. Attempting to parse a 2GB JSON export file causes FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory.

For large datasets, use Streaming JSON Parsers (stream-json in Node.js or ijson in Python):

#4Node.js stream-json Example

import fs from "fs";
import { parser } from "stream-json";
import { streamArray } from "stream-json/streamers/StreamArray";

// Process multi-gigabyte JSON array chunk-by-chunk without memory spikes
fs.createReadStream("large_database_export.json")
  .pipe(parser())
  .pipe(streamArray())
  .on("data", ({ key, value }) => {
    // Process individual record
    console.log(`Record #${key}:`, value.id);
  })
  .on("end", () => console.log("Streaming parsing complete."));

#3JSON Schema: Structural Data Contracts (Draft 2020-12)

JSON Schema is an IETF standard for declaring the structure, validation rules, and documentation of JSON documents:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "UserProduct",
  "type": "object",
  "properties": {
    "id": { "type": "integer" },
    "name": { "type": "string", "minLength": 1 },
    "price": { "type": "number", "exclusiveMinimum": 0 }
  },
  "required": ["id", "name", "price"]
}

Validating JSON inputs against a JSON Schema using libraries like ajv in Node.js or jsonschema in Python guarantees payload structural validity at network API gateways.

#3Mastering JSON.stringify() Replacer & JSON.parse() Reviver

JavaScript's native JSON.stringify() and JSON.parse() methods accept powerful second parameters:

#41. Custom Serialization with Replacer Function

// Filter sensitive keys or convert custom types during serialization
const user = { name: "Alice", passwordHash: "secret123", createdAt: new Date() };

const jsonText = JSON.stringify(user, (key, value) => {
  if (key === "passwordHash") return undefined; // Omit sensitive field
  return value;
}, 2);

#42. Custom Deserialization with Reviver Function

// Automatically convert ISO 8601 string dates into Date objects on parse
const jsonInput = '{"name":"Alice","joined":"2025-02-20T14:30:00Z"}';

const parsed = JSON.parse(jsonInput, (key, value) => {
  if (typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/.test(value)) {
    return new Date(value);
  }
  return value;
});

console.log(parsed.joined instanceof Date); // Output: true

#3Binary Alternatives to JSON for High-Performance Microservices

While JSON is the default format for external public web APIs, high-performance internal microservices often use binary serialization protocols:

• MessagePack: Drop-in binary replacement for JSON that preserves schema-less key-value dynamics.
• gRPC / Protobuf: Ideal for high-throughput microservices where strict static typing and small payload sizes are required.

#25. JSON Security Vectors & Parser Asymmetries

Because JSON is processed across different programming languages in distributed architectures, security vulnerabilities arise from implementation gaps between parsers:

#31. JSON Key Collisions (Duplicate Keys)

{
  "role": "user",
  "role": "admin"
}

RFC 8259 states key names within an object should be unique, but does not mandate rejection. Java Jackson takes the first value (user), while Python json and JavaScript JSON.parse() take the last value (admin). Attackers exploit this parser asymmetry to bypass security gateways.

#32. Prototype Pollution (Node.js)

Unsanitized merging of parsed JSON containing magic keys ("__proto__", "constructor") into application objects can overwrite Object.prototype, causing remote code execution or authentication bypass.

#33. Resource Exhaustion (Deep Nesting)

Recursively parsing JSON nested 10,000 levels deep ({"a":{"a":{"a":...}}}) triggers stack overflow crashes in un-sandboxed parsers.

#26. High-Performance JSON Workflows & Tooling

To maintain fast, secure JSON pipelines:

1. Minify for Production APIs: Remove whitespace to reduce payload size by 20–30%.
2. Enable Brotli / Gzip Compression: JSON text compresses by 80% to 90% over HTTP network streams.
3. Use JSON Schema: Define structural contracts using JSON Schema to validate payloads before processing.
4. Use Local Browsers-Based Tools: Never paste confidential JSON payloads (containing customer data, environment variables, or tokens) into unverified cloud websites.

Use the AllDevToolsHub JSON Validator, JSON Formatter, and JSON Diff Tool to format, validate, and compare JSON payloads locally inside your browser's V8 engine without network transmission.

#2Summary

JSON is the foundation of modern software communication:

1. Six Data Types: String, Number, Object, Array, Boolean, Null.
2. Double Quotes & No Trailing Commas: Strict adherence prevents 95% of syntax failures.
3. Transmit 64-Bit IDs as Strings: Avoid IEEE 754 float precision loss on large integers.
4. Stream Large Datasets: Use streaming parsers (stream-json / ijson) when parsing multi-gigabyte JSON files to avoid VRAM/heap allocation crashes.
5. Evaluate Binary Formats for Internal APIs: Consider Protobuf or MessagePack for microservices requiring high serialization throughput.
6. Validate Locally: Keep sensitive JSON configuration and customer data private using browser-local tools.

Master your JSON data flow privately at the AllDevToolsHub JSON Suite.

#2Related Tools

• JSON Validator, Locate JSON syntax errors with precise line and column highlighting
• JSON Formatter, Prettify and minifying JSON payloads
• JSON Diff Tool, Compare two JSON objects side-by-side visually
• JSON to Schema Converter, Generate JSON Schema specifications from sample data

#2Related Articles

• JSON Validation Errors Explained
• JSON Security: Defense Against Injection and Key Collisions
• Configuration Mastery: YAML vs. JSON vs. TOML

#2Frequently Asked Questions

Q: What is the official MIME type for JSON?

A: The official MIME media type for JSON is application/json (RFC 8259). The character encoding is assumed to be UTF-8 by default.

Q: Why does standard JSON forbid trailing commas?

A: Douglas Crockford designed JSON in 2001 to be a strict subset of JavaScript expressions parsed by early ECMAScript 3 engines, which threw syntax errors on trailing commas in object literals. While modern JS (ES5+) allows trailing commas, the JSON spec (RFC 8259) maintains strict prohibition to ensure 100% backward compatibility across legacy parsers in all languages.

Written by Rahul Jalavadiya, founder of AllDevToolsHub. All tools run locally in your browser.

#2Sources / Further reading

• IETF - RFC 8259: The JavaScript Object Notation (JSON) Data Interchange Format
• MDN Web Docs - Working with JSON
• JSON.org - Official specification and links
• Douglas Crockford - The JSON Saga