JSON Parsing Guide: From Text to Typed Data Safely

Parsing is deserialization

JSON parsing turns a string of text into in-memory values: maps/objects, lists/arrays, strings, numbers, booleans, and null. Serialization goes the other direction. Most bugs appear at these boundaries—when assumptions about shape or types are wrong.

Language snapshots

JavaScript

const data = JSON.parse(text);
const text2 = JSON.stringify(data);

JSON.parse throws SyntaxError on invalid input—always wrap untrusted input in try/catch.

Python

import json
data = json.loads(text)
text2 = json.dumps(data)

Go roughly uses json.Unmarshal into structs with tags.

Regardless of language, prefer parsing into typed structures when the contract is known.

Trust boundaries

Never parse untrusted JSON without:

• Size limits
• Timeouts for huge inputs
• Schema or structural validation for public endpoints
• Careful handling of deeply nested documents (stack/depth limits)

Parser differentials and giant nested arrays are real denial-of-service vectors.

Numbers, precision, and integers

JSON numbers are typically IEEE-754 doubles in JavaScript. That means integers above Number.MAX_SAFE_INTEGER (2^53−1) can lose precision. If you need large IDs, keep them as strings:

{ "id": "9007199254740993" }

Other languages may offer big integers or decimal types—document your choice in the API.

Dates are not a native type

JSON has no date type. Common patterns:

• ISO-8601 strings: "2026-06-16T12:00:00Z"
• Unix epoch numbers (seconds or milliseconds—specify which!)

Parse deliberately. Do not invent ambiguous formats like 06/16/2026 in APIs.

null vs missing keys

{ "nickname": null }

is not the same as {} without nickname. Decide whether your API uses null to clear a field, and teach clients the difference. Parsers preserve null; they cannot invent missing keys.

Revivers and transformers

JavaScript’s JSON.parse(text, reviver) can transform values during parse (for example, turning ISO strings into Date). Use sparingly—revivers that recurse unexpectedly can surprise maintainers. Explicit mapping layers are easier to test.

Debugging parse failures

When JSON.parse fails, log a truncated snippet and the error position if available—not the entire multi-megabyte body. Reproduce with a validator, fix the payload source, and add a regression fixture. JSON Editor is useful for isolating whether the problem is syntax or your mapping code.

Safer production pattern

1. Read raw bytes/string with size caps.
2. Parse JSON in try/catch (or equivalent).
3. Validate with schema or decoder.
4. Map into domain types.
5. Reject unknown critical fields if your policy says so.

Parsing is the doorway to your domain model. Keep the doorway narrow, well-lit, and tested—and your application logic can assume shape instead of defensively checking every key forever.