Every modern web application, cloud infrastructure service, and mobile backend relies on an invisible digital lingua franca to exchange structured information across different programming environments. That universal format is JSON (JavaScript Object Notation).
1. Introduction & History
JSON was popularized in the early 2000s by Douglas Crockford as a lightweight, clean alternative to the bloated complexity of XML (Extensible Markup Language). While designed to mirror the object literal syntax of JavaScript, JSON is completely language-independent and specified by international standards RFC 8259 and ECMA-404.
2. The 6 Fundamental JSON Types
JSON defines exactly six data types. Any payload that contains types outside this list is invalid JSON:
{ "userId": 101, "role": "admin" }[ "production", "staging", "dev" ]"Double-quoted Unicode text"42, 3.14159, -17, 1.2e5true, falsenull3. Strict Syntax & Grammar Rules
Unlike lenient JavaScript engines, JSON parsers enforce zero-tolerance grammar:
- Double Quotes Mandatory: Object keys and string literals must use double quotes (
"key"). Single quotes ('key') cause immediate syntax termination. - No Trailing Commas: Commas are strictly element separators. A comma following the last item in a list or object is a parse error.
- No Comments: Standard JSON does not permit
//or/* */comments.
4. Abstract Syntax Tree (AST) Parsing
When a browser executes JSON.parse(), a deterministic lexical scanner converts raw character tokens into an in-memory Abstract Syntax Tree (AST). The parser tracks token state, verifying matching braces and validating UTF-8 surrogate pairs before producing native objects in memory.
5. JSON vs XML & YAML
While XML excels in document-centric environments with formal schema validation (XSD) and YAML is favored for DevOps configurations, JSON remains the undisputed gold standard for high-throughput HTTP APIs due to its low serialization overhead and native browser compatibility.
6. Security & Best Practices
Never use eval() to parse untrusted JSON input. Always use browser-native JSON.parse(), which executes safe deserialization without script execution risk.