What is the difference between JSON.parse() and eval() for JSON?

Always use JSON.parse(). eval() executes any JavaScript expression — including malicious code — making it a serious security vulnerability (remote code execution) when parsing untrusted input. JSON.parse() only accepts valid JSON, making it safe to use with user-provided or API data.

JSON

7 min readMar 27, 2026

How to Format and Validate JSON — A Complete Guide

Whether you are debugging an API response, editing a configuration file, or cleaning up data from a third-party source, properly formatted JSON makes the difference between a 2-minute fix and a 2-hour debugging session. Here is everything you need to know.

What Does "Formatting JSON" Actually Mean?

Formatting (also called "pretty-printing" or "beautifying") JSON adds whitespace — newlines and indentation — to make the structure readable. The data itself is completely unchanged; only whitespace differs.

Minified

{"user":{"id":1,"name":"Alice","roles":["admin","editor"],"active":true}}

Formatted (2-space indent)

{
  "user": {
    "id": 1,
    "name": "Alice",
    "roles": [
      "admin",
      "editor"
    ],
    "active": true
  }
}

JSON Syntax Rules (The Complete List)

JSON is defined by ECMA-404 and RFC 8259. The spec is deliberately small:

1Keys must be strings wrapped in double quotes — not single quotes, not unquoted.
2String values must use double quotes. Escape special characters with backslash: \" \n \t \\
3Valid value types: string, number, object, array, true, false, null. No undefined, no NaN, no Infinity, no Date.
4No trailing commas after the last item in an array or the last property in an object.
5No comments of any kind — not // and not /* */.
6Numbers: no leading zeros (007 is invalid), decimal notation only (1e3 is valid for 1000).
7The root value can be any JSON value — it does not have to be an object.

The 10 Most Common JSON Errors

Trailing comma

{ "name": "Alice", }

Fix: Remove the comma before }. JSON does not allow trailing commas.

Single quotes

{ 'name': 'Alice' }

Fix: Use double quotes for both keys and string values.

Unquoted keys

{ name: 'Alice' }

Fix: All keys must be double-quoted strings: { "name": "Alice" }

undefined value

{ "value": undefined }

Fix: JSON has no undefined type. Use null, omit the key, or convert to a string.

NaN or Infinity

{ "ratio": NaN }

Fix: JSON does not support NaN or Infinity. Use null or a sentinel value like -1.

Missing comma between properties

{ "a": 1 "b": 2 }

Fix: Add a comma after each property except the last: { "a": 1, "b": 2 }

Comments

{ // page size
"limit": 20 }

Fix: JSON does not support comments. Remove them or switch to JSONC/YAML.

Invalid escape sequence

{ "path": "C:\Users\file" }

Fix: Backslashes must be doubled: { "path": "C:\\Users\\file" }

Numbers with leading zeros

{ "code": 007 }

Fix: Leading zeros are invalid in JSON numbers. Use 7, or use a string "007".

BOM (Byte Order Mark)

\uFEFF{ "key": "value" }

Fix: Some editors add a BOM at the start of UTF-8 files. Strip it before parsing.

Formatting JSON in Code

Use JSON.stringify() with the indent argument to produce pretty-printed output:

const data = { name: "Alice", roles: ["admin"], active: true };

// Minified (default)
JSON.stringify(data);
// '{"name":"Alice","roles":["admin"],"active":true}'

// Pretty-printed with 2-space indent
JSON.stringify(data, null, 2);
// {
//   "name": "Alice",
//   "roles": [
//     "admin"
//   ],
//   "active": true
// }

// Parse and reformat raw JSON string
const formatted = JSON.stringify(JSON.parse(rawJsonString), null, 2);

Formatting vs Validation vs Schema Validation

These are three distinct operations that are often confused:

Formatting:Adds whitespace to make JSON readable. Never changes the data. Always safe.
Syntax validation:Checks whether the string is valid JSON (JSON.parse() throws if not). Does not check what the data contains.
Schema validation:Checks whether the JSON data matches a defined structure — field types, required properties, value ranges. Use JSON Schema, Zod, Ajv, or Yup for this.

JSON Formatting Best Practices

2-space indentation is the most common convention for JSON config files. 4 spaces is also widely used. Pick one and be consistent.
Minify for production API responses — whitespace is bandwidth. Always keep source files formatted.
Sort keys alphabetically in configuration files — makes git diffs cleaner and easier to review.
Use JSON.parse(), never eval() for parsing user-supplied or API data. eval() executes arbitrary JavaScript and is a remote code execution vulnerability.
In VS Code, format any JSON file with Shift+Alt+F (Windows/Linux) or Shift+Option+F (Mac). Prettier handles JSON out of the box.

Format and validate JSON instantly

The noserver JSON Formatter pretty-prints, validates, and lets you explore any JSON structure — with syntax highlighting and tree view. Runs entirely in your browser.

Open JSON Formatter

Frequently Asked Questions

What is the difference between JSON and JSONC?+

JSONC is JSON with Comments — used by VS Code settings and TypeScript's tsconfig.json. It allows // and /* */ comments. Standard JSON.parse() will throw on JSONC input.

Why doesn't JSON support comments?+

Douglas Crockford intentionally removed comments. His reasoning: comments would be used for parsing directives, breaking interoperability. For human-edited config files, use JSONC or YAML instead.

Can JSON have trailing commas?+

No. Trailing commas after the last item in an array or last property in an object are a syntax error. They cause JSON.parse() to throw. JSONC and JSON5 do allow trailing commas.

What is the maximum size for a JSON file?+

The spec defines no limit. Node.js (V8) can parse JSON up to ~512 MB in a single call. For very large datasets, use streaming parsers or NDJSON (newline-delimited JSON).

How do I validate JSON in VS Code?+

VS Code validates .json files automatically. For JSON Schema validation, add a '$schema' key or configure 'json.schemas' in settings. The JSON Language Server highlights errors inline.

What is the difference between JSON.parse() and eval()?+

Always use JSON.parse(). eval() executes any JavaScript expression — including malicious code — making it a remote code execution vulnerability with untrusted input. JSON.parse() only accepts valid JSON.

Is JSON case-sensitive?+

Yes. 'Name', 'name', and 'NAME' are three distinct keys. Boolean values true and false must be lowercase — 'True' or 'TRUE' causes a parse error.