JSON, or JavaScript Object Notation, is a lightweight text-based data interchange format designed to represent structured values in a syntax derived from JavaScript object and array notation. JSON represents objects, arrays, strings, numbers, booleans and null. Objects contain name-value pairs, while arrays contain ordered values, and values can be nested to arbitrary practical depth subject to parser and application limitations.
JSON is widely used for web APIs, configuration, data interchange, logging and application state because it is relatively compact, easy for humans to inspect and supported by virtually every modern programming environment. Despite its historical relationship with JavaScript, JSON is language-independent as a data interchange format and does not require a JavaScript runtime.
JSON became prominent through web development in the early twenty-first century, although its syntax is closely related to object notation already used in JavaScript. Douglas Crockford is strongly associated with the popularisation and standardisation of JSON as a lightweight interchange format. JSON was standardised through specifications including ECMA-404 and IETF RFC 8259. The format became central to the rise of REST-style web APIs and browser-based applications, where it often replaced XML for relatively straightforward data exchange. Its adoption is partly explained by the direct mapping between JSON structures and common data structures such as dictionaries, maps, arrays, lists and primitive values in programming languages.
JSON syntax is intentionally constrained. An object is enclosed in curly braces and contains comma-separated name-value pairs, with member names represented as strings. An array is enclosed in square brackets and contains comma-separated values. Strings use double quotation marks and support escape sequences. JSON numbers support a decimal notation but do not define separate integer and floating-point types at the format level. JSON has the literal values true, false and null. JSON does not have native comments, dates, functions, undefined, binary data types or arbitrary object instances. Applications therefore need conventions or additional encoding schemes when their data requires concepts outside JSON's basic model.
JSON's simplicity is also one of its limitations. A JSON document can express nested objects and arrays effectively, but it does not inherently provide a formal schema, references, namespaces or rich type annotations. JSON Schema is commonly used when applications require machine-readable rules for validating JSON structure and values. API specifications such as OpenAPI can further describe how JSON representations are used in network interfaces. Dates are often represented as strings following an agreed convention, while binary data may be encoded using formats such as Base64, increasing size compared with raw binary transmission. Consequently, JSON's apparent simplicity depends partly on external conventions established by applications and protocols.
JSON is particularly common in HTTP APIs. A client might send a JSON request body containing user information, while the server responds with another JSON object containing identifiers, status information or related records. HTTP itself does not require JSON; it is a representation format carried within HTTP messages. Content-Type headers such as application/json identify the representation format. JSON can also be used in files, message queues, database fields and event streams. Large-scale systems frequently use JSON in logs and event records because its self-describing object structure makes records easier to process with general-purpose tooling, although compact binary formats can be more efficient for high-volume systems.
JSON differs from JavaScript objects even though the notation is historically related. JSON is a serialised textual representation governed by its own grammar, whereas a JavaScript object is an in-memory language construct that can contain functions, symbols, undefined and other values that JSON cannot represent directly. JSON.parse converts JSON text into JavaScript values, while JSON.stringify serialises supported JavaScript values into JSON text.
JSON also differs from XML because JSON generally has less syntactic overhead and a simpler basic data model, while XML offers features such as attributes, namespaces, mixed content and mature schema and transformation technologies. YAML can represent JSON-compatible data but provides a more extensive syntax intended partly for human authoring.
Security considerations apply to JSON primarily through how applications consume it rather than through the basic data syntax itself. Untrusted JSON must be parsed using appropriate libraries rather than executed as source code. Applications must validate expected types, ranges, structures and permissions rather than assuming syntactic validity means semantic validity. Excessively deeply nested or extremely large JSON can create resource-exhaustion risks, and unsafe deserialisation mechanisms in programming environments can create more serious vulnerabilities when they extend beyond ordinary JSON parsing. API implementations must also consider authentication, authorisation, input validation, output encoding and transport security.
JSON's major strengths are simplicity, broad language support, relatively compact syntax and convenient mapping to common application data structures. Its weaknesses include limited native types, lack of comments, lack of built-in schema validation, potential ambiguity around numbers and dates, and sometimes significant overhead when transmitting extremely large or high-performance datasets. Nevertheless, JSON has become one of the dominant general-purpose interchange formats in modern software. Its importance extends beyond JavaScript and browsers into cloud services, microservices, databases, automation systems, configuration, observability and distributed architectures. Understanding JSON accurately requires distinguishing the format itself from conventions imposed by APIs, programming languages, schema systems and application protocols.
