JSON
Douglas Crockford sent the first JSON message in April 2001. He and Chip Morningstar created this format at State Software, a company they cofounded that March. The team needed a way to communicate between servers and browsers without relying on Flash or Java applets. These plugins dominated web development in the early 2000s but required extra software installations. Developers wanted to use standard browser capabilities instead. They held round-table discussions to decide how to name their new data format. The group voted between calling it JSML or JSON. They chose JavaScript Object Notation for its clarity. The JSON.org website launched later that same year to host documentation. Yahoo! began offering some of its Web services using JSON in December 2005. This move helped popularize the format across the industry.
Ecma International published the first edition of ECMA-404 in October 2013. This marked the formal standardization of the format after years of informal use. The Internet Engineering Task Force released RFC 8259 on the 13th of December 2017. That document became the current version of Internet Standard STD 90. ISO/IEC JTC 1/SC 22 also published ISO/IEC 21778:2017 in November 2017. These three standards describe only the allowed syntax of the format. The RFC covers additional security and interoperability considerations. Douglas Crockford added a clause to the original license stating the software must be used for good not evil. This clause created compatibility problems with other open-source licenses. The clause mocked corporate lawyers while attempting to keep the code free. Open-source software usually implies no restrictions on purpose of use. Jake Edge wrote about these licensing issues on LWN.net in November 2016.
A JSON object uses curly brackets to delimit name-value pairs. Keys inside objects are strings enclosed in double quotation marks. Values can be numbers, strings, booleans, arrays, or null. Arrays use square bracket notation with comma-separated elements. Whitespace is ignored around syntactic elements but never within string values. Four specific characters count as whitespace including space, horizontal tab, line feed, and carriage return. The byte order mark must not be generated by conforming implementations. Comments were intentionally excluded from the specification. Douglas Crockford removed them because people used them to hold parsing directives. He believed this practice would destroy interoperability between systems. Trailing commas after the last value inside a data structure are disallowed. Early versions required valid text to consist only of an object or array type. Later revisions redefined text as any serialized value. Numbers may contain fractional parts and use exponential E notation. No distinction exists between integer and floating-point formats in the standard.
JSON exchange in open ecosystems must be encoded in UTF-8. This encoding supports the full Unicode character set including those outside the Basic Multilingual Plane. Characters outside U+0000 to U+FFFF must be written using UTF-16 surrogate pairs if escaped. For example, an emoji like the neutral face appears as either raw text or escaped sequences. The vast majority of implementations assume UTF-8 encoding for maximum portability. Specifications allow JSON objects with multiple members having the same name. Behavior when processing such objects remains unpredictable across different systems. Applications should avoid duplicate names when transmitting JSON objects. Order of members in objects carries no significance according to specifications. Parsing software might make ordering visible but applications should ignore it. Number literals have no limits on magnitude or precision within the spec. JavaScript stores them as IEEE754 binary64 quantities which creates interoperability issues. Some implementations treat 42, 42.0, and 4.2E+1 as identical numbers while others do not. The IETF published RFC 8259 in 2015 describing a restricted profile called I-JSON Message Format. This format constrains syntax to avoid known interoperability problems.
Passing valid JSON texts to the JavaScript eval function is unsafe despite common misconceptions. Certain valid JSON texts containing line terminators were not valid JavaScript code until 2019 updates. Older engines may fail to support these characters correctly. A new function named JSON.parse was added to ECMAScript fifth edition to handle parsing safely. Major browsers supported this function by 2017. Douglas Crockford provided an API-compatible library for non-supported browsers. Various parser implementations suffered from denial-of-service attacks and mass assignment vulnerabilities. Executing arbitrary code from the internet introduces many pitfalls. TC39 made ECMAScript a strict JSON superset in its 2019 revision. This change resolved earlier discrepancies between JSON and JavaScript syntax. Security risks arise when developers assume JSON equals executable code without validation. Proper parsers prevent execution of malicious scripts embedded within data streams.
YAML version 1.2 serves as a superset of JSON with prior versions lacking strict compatibility. Escaping slashes differently creates validity issues between formats. YAML supports comments while JSON does not. HOCON functions as another human-optimized config object notation format used by Play Framework. Lightbend developed HOCON specifically for configuration needs in .NET projects via Akka.NET. TIBCO Streaming uses it as the primary file format for products like StreamBase and LiveView. Exabeam Advanced Analytics relies on HOCON for subsystem configurations. Jitsi adopted it as its new config system with properties files acting as fallbacks. JSON5 started development in 2012 and reached version 1.0.0 in 2018. It allows optional trailing commas, unquoted keys, single quoted strings, multiline text, and additional number formats. SQLite supports JSON5 syntax as an extension to standard JSON rules. Microsoft Visual Studio Code uses JSONC which accepts single-line and block comments. Trailing commas are discouraged but trigger warnings rather than errors in that editor. CBOR offers faster processing at the cost of human readability compared to textual formats. Google Protocol Buffers fill similar niches without requiring schema definitions.
MongoDB uses JSON-like data structures for its document-oriented database systems. Relational databases added native support including PostgreSQL's JSONB type and MySQL's JSON type. Developers can insert JSON directly without converting to other formats. MongoDB stores documents using this flexible structure instead of rigid tables. Cloud infrastructure engineering tools utilize Jsonnet as a configuration language. Eric Liang and Aaron Davidson wrote about declarative infrastructure using Jsonnet templates in 2017. William Hegedus covered mastering Prometheus in 2024 pages 194 through 198. GeoJSON represents simple geographical features while JSON-LD encodes linked data methods. JSON-RPC enables remote procedure calls encoded within JSON messages. Smile serves as a binary computer data interchange format imitating JSON with fewer bytes required. UBJSON mimics JSON syntax but requires less storage space overall. Jackson API provides robust handling capabilities across multiple programming languages. jq functions as both a query language and high-level programming tool for JSON data. These derivatives extend functionality beyond basic object notation requirements. Modern web applications rely heavily on these standardized formats for efficient communication.
Common questions
Who created JSON and when was the first message sent?
Douglas Crockford sent the first JSON message in April 2001. He and Chip Morningstar created this format at State Software, a company they cofounded that March.
When did Ecma International publish the first edition of ECMA-404?
Ecma International published the first edition of ECMA-404 in October 2013. This marked the formal standardization of the format after years of informal use.
What characters are allowed as whitespace in JSON syntax?
Four specific characters count as whitespace including space, horizontal tab, line feed, and carriage return. Whitespace is ignored around syntactic elements but never within string values.
Why were comments intentionally excluded from the original JSON specification?
Douglas Crockford removed them because people used them to hold parsing directives. He believed this practice would destroy interoperability between systems.
Which organization released RFC 8259 on the 13th of December 2017?
The Internet Engineering Task Force released RFC 8259 on the 13th of December 2017. That document became the current version of Internet Standard STD 90.
How does YAML version 1.2 differ from JSON regarding comments?
YAML supports comments while JSON does not. Escaping slashes differently creates validity issues between formats.