RFC 8259

The JavaScript Object Notation (JSON) Data Interchange Format

📅 published December 2017, from ietf

The JavaScript Object Notation (JSON) Data Interchange Format 🎀

Okay bestie, so this is RFC 8259 💅. It's an IETF document (Internet Engineering Task Force), and it's a Standards Track document, so this is the real deal ✨. The editor is T. Bray, Ed., from Textuality, and it's dated December 2017 🍓. It obsoletes RFC 7159, which means it replaces that one. Its ISSN is 2070-1721 🦋. The title block doesn't list anything it updates.

Internet Engineering Task Force (IETF)                      T. Bray, Ed.
Request for Comments: 8259                                    Textuality
Obsoletes: 7159                                            December 2017
Category: Standards Track
ISSN: 2070-1721

Abstract ✨

JavaScript Object Notation (JSON) is a lightweight, text-based, language-independent data interchange format 🌸. It came out of the ECMAScript Programming Language Standard, and it has a small set of formatting rules for showing structured data in a portable way 💖. This document clears up inconsistencies with other JSON specs, fixes spec errors, and gives experience-based interoperability guidance 🫶.

Status of This Memo 📜

This is an Internet Standards Track document 🔥.

It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG) 👑. If you want more info on Internet Standards, check Section 2 of RFC 7841 🧚.

For the current status, any errata, and how to give feedback, go to https://www.rfc-editor.org/info/rfc8259 💜.

Copyright Notice 🎀

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the date of publication 💅. Please read these carefully, because they explain your rights and restrictions for this document 🙈. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 🫶.

This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008 🍓. The people controlling the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process 😭. Unless you get an adequate license from whoever controls that copyright, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process 💀. The exceptions are formatting it for publication as an RFC or translating it into languages other than English ✨.

Table of Contents 🗂️

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
  1.1.  Conventions Used in This Document . . . . . . . . . . . .   4
  1.2.  Specifications of JSON  . . . . . . . . . . . . . . . . .   4
  1.3.  Introduction to This Revision . . . . . . . . . . . . . .   5
2.  JSON Grammar  . . . . . . . . . . . . . . . . . . . . . . . .   5
3.  Values  . . . . . . . . . . . . . . . . . . . . . . . . . . .   6
4.  Objects . . . . . . . . . . . . . . . . . . . . . . . . . . .   6
5.  Arrays  . . . . . . . . . . . . . . . . . . . . . . . . . . .   7
6.  Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . .   7
7.  Strings . . . . . . . . . . . . . . . . . . . . . . . . . . .   8
8.  String and Character Issues . . . . . . . . . . . . . . . . .   9
  8.1.  Character Encoding  . . . . . . . . . . . . . . . . . . .   9
  8.2.  Unicode Characters  . . . . . . . . . . . . . . . . . . .  10
  8.3.  String Comparison . . . . . . . . . . . . . . . . . . . .  10
9.  Parsers . . . . . . . . . . . . . . . . . . . . . . . . . . .  10
10. Generators  . . . . . . . . . . . . . . . . . . . . . . . . .  10
11. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  11
12. Security Considerations . . . . . . . . . . . . . . . . . . .  12
13. Examples  . . . . . . . . . . . . . . . . . . . . . . . . . .  12
14. References  . . . . . . . . . . . . . . . . . . . . . . . . .  14
  14.1.  Normative References . . . . . . . . . . . . . . . . . .  14
  14.2.  Informative References . . . . . . . . . . . . . . . . .  14
Appendix A.  Changes from RFC 7159  . . . . . . . . . . . . . . .  16
Contributors  . . . . . . . . . . . . . . . . . . . . . . . . . .  16
Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  16

1. Introduction 🦋

JSON is a text format for serializing structured data 💖. It's derived from the object literals of JavaScript, as defined in the ECMAScript Programming Language Standard, Third Edition [ECMA-262] 🧚.

JSON can represent four primitive types (strings, numbers, booleans, and null) and two structured types (objects and arrays) ✨.

A string is a sequence of zero or more Unicode characters [UNICODE] 🌸. This citation points to the latest version of Unicode, not one specific release. It isn't expected that future Unicode changes will affect the syntax of JSON 🫶.

An object is an unordered collection of zero or more name/value pairs. A name is a string, and a value is a string, number, boolean, null, object, or array 👑.

An array is an ordered sequence of zero or more values 🎀.

The terms "object" and "array" come from JavaScript conventions 💅.

JSON was designed to be minimal, portable, textual, and a subset of JavaScript 🌈.

1.1. Conventions Used in This Document 📏

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 🔥.

The grammatical rules in this document are to be interpreted as described in [RFC5234] 🍓.

1.2. Specifications of JSON 📚

This document replaces [RFC7159]. [RFC7159] obsoleted [RFC4627], which originally described JSON and registered the media type "application/json" 💜.

JSON is also described in [ECMA-404] 🌸.

The reference to ECMA-404 in the previous sentence is normative. That doesn't mean implementors have to consult it to understand this document. It's there to show that there are no inconsistencies in the definition of the term "JSON text" across any of its specifications. Note, however, that ECMA-404 allows several practices that this specification recommends avoiding, for the sake of maximal interoperability 🙈.

The goal is for the grammar to be the same across the two documents, even though they describe it differently. If a difference turns up between them, ECMA and the IETF will work together to update both documents 🤝.

If an error turns up in either document, the other should be checked to see whether it has a similar error. If it does, it should be fixed, if possible 👀.

If either document changes in the future, ECMA and the IETF will work together to keep the two documents aligned through the change 🫶.

1.3. Introduction to This Revision 🎀

Since RFC 4627 was published, JSON has become very widely used 🌈. That experience has revealed certain patterns that, although the specifications allow them, have caused interoperability problems 😭.

A few errata have also been reported. For RFC 4627, those are RFC Errata IDs 607 [Err607] and 3607 [Err3607]. For RFC 7159, they're RFC Errata IDs 3915 [Err3915], 4264 [Err4264], 4336 [Err4336], and 4388 [Err4388] ✨.

The goal of this document is to apply those errata, remove inconsistencies with other JSON specifications, and call out practices that can lead to interoperability problems 💅.

2. JSON Grammar 🧩

A JSON text is a sequence of tokens. The set of tokens includes six structural characters, strings, numbers, and three literal names 🍓.

A JSON text is a serialized value. Some earlier JSON specs limited a JSON text to being an object or an array. Implementations that generate only objects or arrays wherever a JSON text is called for will still be interoperable, because all implementations will accept those as conforming JSON texts 💖.

   JSON-text = ws value ws

These are the six structural characters 🦋:

   begin-array     = ws %x5B ws  ; [ left square bracket

   begin-object    = ws %x7B ws  ; { left curly bracket

   end-array       = ws %x5D ws  ; ] right square bracket

   end-object      = ws %x7D ws  ; } right curly bracket

   name-separator  = ws %x3A ws  ; : colon

   value-separator = ws %x2C ws  ; , comma

Insignificant whitespace is allowed before or after any of the six structural characters 🫧.

   ws = *(
           %x20 /              ; Space
           %x09 /              ; Horizontal tab
           %x0A /              ; Line feed or New line
           %x0D )              ; Carriage return

3. Values 💎

A JSON value MUST be an object, array, number, or string, or one of the following three literal names:

   false
   null
   true

The literal names MUST be lowercase. No other literal names are allowed 🙅‍♀️.

   value = false / null / true / object / array / number / string

   false = %x66.61.6c.73.65   ; false

   null  = %x6e.75.6c.6c      ; null

   true  = %x74.72.75.65      ; true

4. Objects 🌷

An object structure is a pair of curly brackets surrounding zero or more name/value pairs (or members) 💜. A name is a string 🎀. A single colon comes after each name, separating the name from the value 🍓. A single comma separates a value from the name that follows it ✨. The names within an object SHOULD be unique 🔑.

   object = begin-object [ member *( value-separator member ) ]
            end-object

   member = string name-separator value

An object whose names are all unique is interoperable, in the sense that all software implementations receiving that object will agree on the name-value mappings 🤝. When the names within an object aren't unique, the behavior of software receiving that object is unpredictable 😵. Many implementations report only the last name/value pair. Others report an error or fail to parse the object, and some report all of the name/value pairs, duplicates included 🌀.

JSON parsing libraries have been observed to differ on whether they make the ordering of object members visible to calling software 👀. Implementations whose behavior doesn't depend on member ordering will be interoperable in the sense that they won't be affected by those differences 🫶.

5. Arrays 🍡

An array structure is square brackets surrounding zero or more values (or elements) 🧺. Elements are separated by commas 🎀.

   array = begin-array [ value *( value-separator value ) ] end-array

There's no requirement that the values in an array be the same type 🌈.

6. Numbers 🔢✨

okay so numbers in JSON are giving "familiar from every programming language you've ever touched" 💖. A number is written in base 10 using decimal digits 🍓. It has an integer part that can start with an optional minus sign ➖, and then it can have a fraction part and/or an exponent part 🦋. Leading zeros are NOT allowed, bestie 🙅‍♀️. Like, 0123 is a no-go.

A fraction part is just a decimal point followed by one or more digits 🌸.

An exponent part starts with the letter E, uppercase or lowercase, and it can be followed by a plus or minus sign 🎀. The E and that optional sign are then followed by one or more digits. Iconic 👑.

Numeric values that can't be written in the grammar below, like Infinity and NaN, are NOT permitted 💀. Not me trying to sneak NaN into my JSON 🙈.

number = [ minus ] int [ frac ] [ exp ]

decimal-point = %x2E ; .

digit1-9 = %x31-39 ; 1-9

e = %x65 / %x45 ; e E

exp = e [ minus / plus ] 1*DIGIT

frac = decimal-point 1*DIGIT int = zero / ( digit1-9 *DIGIT )

minus = %x2D ; -

plus = %x2B ; +

zero = %x30 ; 0

This spec lets implementations set limits on the range and precision of the numbers they accept 📏. Software that uses IEEE 754 binary64 (double precision) numbers [IEEE754] is generally available and widely used 🫶, so good interop can happen when implementations expect no more precision or range than those provide. Implementations will approximate JSON numbers within the expected precision 🧚. A JSON number like 1E400 or 3.141592653589793238462643383279 may signal interop problems 😭, because it suggests the software that made it expects the receiver to have more magnitude and precision than is widely available. Like, bestie, that's a lot of expectation 💅.

Note that when that kind of software is used, integers in the range [-(253)+1, (253)-1] are interoperable 💜. Implementations will agree exactly on their numeric values for those, and that's so satisfying ✨.

7. Strings 🎀

The way strings work is similar to the conventions used in the C family of programming languages 🌈. A string begins and ends with quotation marks. All Unicode characters can go inside those quotation marks, EXCEPT the characters that MUST be escaped: quotation mark, reverse solidus, and the control characters (U+0000 through U+001F) 🚫. Those MUST be escaped, no exceptions, periodt 💅.

Any character may be escaped 🦋. If the character is in the Basic Multilingual Plane (U+0000 through U+FFFF), it can be written as a six-character sequence: a reverse solidus, then the lowercase letter u, then four hexadecimal digits that encode the code point 🔢. The hex letters A through F can be uppercase or lowercase 🍓. So, for example, a string with only one reverse solidus character can be written as "\u005C" 🙈.

There are also two-character escape sequences for some popular characters 🌸. So a string with only one reverse solidus character can be written more compactly as "\\" ✨.

To escape an extended character that's NOT in the Basic Multilingual Plane, you write it as a 12-character sequence that encodes the UTF-16 surrogate pair 🧚. For example, a string with only the G clef character (U+1D11E) can be written as "\uD834\uDD1E" 🎶.

string = quotation-mark *char quotation-mark

char = unescaped / escape ( %x22 / ; " quotation mark U+0022 %x5C / ; \ reverse solidus U+005C %x2F / ; / solidus U+002F %x62 / ; b backspace U+0008 %x66 / ; f form feed U+000C %x6E / ; n line feed U+000A %x72 / ; r carriage return U+000D %x74 / ; t tab U+0009 %x75 4HEXDIG ) ; uXXXX U+XXXX

escape = %x5C ; \

quotation-mark = %x22 ; "

unescaped = %x20-21 / %x23-5B / %x5D-10FFFF

8. String and Character Issues 🧐

8.1. Character Encoding 🔤

JSON text that gets exchanged between systems NOT part of a closed ecosystem MUST be encoded using UTF-8 [RFC3629] 💖. Like, this is a MUST, no cap 🫶.

Earlier JSON specs didn't require UTF-8 when transmitting JSON text 🦋. BUT the vast majority of JSON software has picked UTF-8 anyway, to the point where it's the only encoding that actually achieves interop 👑. Iconic behavior 🌈.

Implementations MUST NOT add a byte order mark (U+FEFF) to the beginning of a networked-transmitted JSON text 🙅‍♀️. Not me adding a BOM to my sweet little JSON 💀. But for interop, implementations that parse JSON texts MAY ignore a byte order mark instead of treating it as an error 🌸.

8.2. Unicode Characters 🌍

When all the strings in a JSON text are made up entirely of Unicode characters [UNICODE] (however they're escaped), that JSON text is interoperable 💜. All software implementations that parse it will agree on the contents of names and of string values in objects and arrays ✨.

HOWEVER, the ABNF in this spec allows member names and string values to contain bit sequences that can't encode Unicode characters 😭. An example is "\uDEAD", a single unpaired UTF-16 surrogate 💀. This has actually been observed, for example when a library truncates a UTF-16 string without checking whether the truncation split a surrogate pair 🙈. The behavior of software that receives JSON texts with such values is unpredictable 🌪️. For example, implementations might return different values for the length of a string value, or even suffer fatal runtime exceptions 💀.

8.3. String Comparison 🔍

Software implementations are typically required to test names of object members for equality 🧩. Implementations that turn the textual representation into sequences of Unicode code units and then compare them numerically, code unit by code unit, are interoperable 💖. They'll agree in all cases on equality or inequality of two strings 🫶. For example, implementations that compare strings with escaped characters unconverted may incorrectly find that "a\\b" and "a\u005Cb" are not equal 😭. Not the vibe 💅.

9. Parsers 🧚

A JSON parser transforms a JSON text into another representation 🦋. A JSON parser MUST accept all texts that conform to the JSON grammar 💅. A JSON parser MAY accept non-JSON forms or extensions ✨.

An implementation MAY set limits on the size of texts that it accepts 📏. It MAY set limits on the maximum depth of nesting 🪆. It MAY set limits on the range and precision of numbers 🔢. And it MAY set limits on the length and character contents of strings 🎀.

10. Generators 🖨️

A JSON generator produces JSON text 🌸. The resulting text MUST strictly conform to the JSON grammar 👑. No wiggle room, bestie 💅.

11. IANA Considerations 📋

The media type for JSON text is application/json 💖.

Type name: application

Subtype name: json

Required parameters: n/a

Optional parameters: n/a

Encoding considerations: binary

Security considerations: See RFC 8259, Section 12

Interoperability considerations: Described in RFC 8259

Published specification: RFC 8259

Applications that use this media type: JSON has been used to exchange data between applications written in all of these programming languages: ActionScript, C, C#, Clojure, ColdFusion, Common Lisp, E, Erlang, Go, Java, JavaScript, Lua, Objective CAML, Perl, PHP, Python, Rebol, Ruby, Scala, and Scheme.

Additional information: Magic number(s): n/a File extension(s): .json Macintosh file type code(s): TEXT

Person & email address to contact for further information: IESG <iesg@ietf.org>

Intended usage: COMMON

Restrictions on usage: none

Author: Douglas Crockford <douglas@crockford.com>

Change controller: IESG <iesg@ietf.org>

Note: No "charset" parameter is defined for this registration. Adding one really has no effect on compliant recipients.

12. Security Considerations 🚨

Okay, serious moment 🫶. Generally, there are security issues with scripting languages 😬. JSON is a subset of JavaScript but excludes assignment and invocation 💅.

Since JSON's syntax is borrowed from JavaScript, it's possible to use that language's eval() function to parse most JSON texts (but NOT all 💀; certain characters such as U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR are legal in JSON but not JavaScript 🙈). This generally constitutes an unacceptable security risk 🚨, since the text could contain executable code along with data declarations 😭. The same consideration applies to the use of eval()-like functions in any other programming language in which JSON texts conform to that language's syntax 🔥. Don't eval your JSON, bestie 💜.

13. Examples 🍓

This is a JSON object 🎀:

{ "Image": { "Width": 800, "Height": 600, "Title": "View from 15th Floor", "Thumbnail": { "Url": "http://www.example.com/image/481989943", "Height": 125, "Width": 100 }, "Animated" : false, "IDs": [116, 943, 234, 38793] } }

Its Image member is an object whose Thumbnail member is an object and whose IDs member is an array of numbers 🌸.

This is a JSON array containing two objects 🦋:

[ { "precision": "zip", "Latitude": 37.7668, "Longitude": -122.3959, "Address": "", "City": "SAN FRANCISCO", "State": "CA", "Zip": "94107", "Country": "US" }, { "precision": "zip", "Latitude": 37.371991, "Longitude": -122.026020, "Address": "", "City": "SUNNYVALE", "State": "CA", "Zip": "94085", "Country": "US" } ]

Here are three small JSON texts containing only values 🧚:

"Hello world!"

true

14. References 📚

14.1. Normative References 💅

[ECMA-404] Ecma International, "The JSON Data Interchange Format", Standard ECMA-404, <http://www.ecma-international.org/publications/ standards/Ecma-404.htm>.

[IEEE754] IEEE, "IEEE Standard for Floating-Point Arithmetic", IEEE 754.

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>.

[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 2003, <https://www.rfc-editor.org/info/rfc3629>.

[RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", STD 68, RFC 5234, DOI 10.17487/RFC5234, January 2008, <https://www.rfc-editor.org/info/rfc5234>.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[UNICODE] The Unicode Consortium, "The Unicode Standard", <http://www.unicode.org/versions/latest/>.

14.2. Informative References ✨

okay so these are the informative references, bestie 📚 they're the extra reading that backs up the spec without being required to implement it. the ECMA-262 link is super long and gets chopped across lines below, and that's exactly how it appears in the original 🫶

[ECMA-262] Ecma International, "ECMAScript Language Specification",
           Standard ECMA-262, Third Edition, December 1999,
           <http://www.ecma-international.org/publications/files/
           ECMA-ST-ARCH/
           ECMA-262,%203rd%20edition,%20December%201999.pdf>.

[Err3607]  RFC Errata, Erratum ID 3607, RFC 4627,
           <https://www.rfc-editor.org/errata/eid3607>.

[Err3915]  RFC Errata, Erratum ID 3915, RFC 7159,
           <https://www.rfc-editor.org/errata/eid3915>.

[Err4264]  RFC Errata, Erratum ID 4264, RFC 7159,
           <https://www.rfc-editor.org/errata/eid4264>.

[Err4336]  RFC Errata, Erratum ID 4336, RFC 7159,
           <https://www.rfc-editor.org/errata/eid4336>.

[Err4388]  RFC Errata, Erratum ID 4388, RFC 7159,
           <https://www.rfc-editor.org/errata/eid4388>.

[Err607]   RFC Errata, Erratum ID 607, RFC 4627,
           <https://www.rfc-editor.org/errata/eid607>.

[RFC4627]  Crockford, D., "The application/json Media Type for
           JavaScript Object Notation (JSON)", RFC 4627,
           DOI 10.17487/RFC4627, July 2006,
           <https://www.rfc-editor.org/info/rfc4627>.

[RFC7159]  Bray, T., Ed., "The JavaScript Object Notation (JSON) Data
           Interchange Format", RFC 7159, DOI 10.17487/RFC7159, March
           2014, <https://www.rfc-editor.org/info/rfc7159>.

Appendix A. Changes from RFC 7159 🌸

okay this part is the glow-up log 💅 it lists what changed between this document and RFC 7159, so you can see the receipts ✨

Section 1.2 got updated for a few reasons: the JSON spec got removed from ECMA-262, ECMA-404 became a normative reference, and the meaning of "normative" got spelled out 📖
Section 1.3 now reflects errata filed against RFC 7159, not RFC 4627 🔍
Section 8.1 changed so that UTF-8 is required when JSON is sent over a network 🌈
Section 12 got a sharper description of the security risk that comes with using the ECMAScript eval() function 🙈
Section 14.1 now includes ECMA-404 as a normative reference ✨
Section 14.2 dropped ECMA-404, bumped the version of ECMA-262, and refreshed the errata list 🫶

Contributors 🎀

RFC 4627 was written by Douglas Crockford 👑 this document was made by changing a relatively small number of things in that one, so ngl the vast majority of the text is still his 💜

Author's Address 🦋

Tim Bray (editor) Textuality

Email: tbray@textuality.com

📦 where this page comes from

ietf: rfc8259 2017-12
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms