Reviewed and updated 24 July 2026
JSONFormatView guide
JSON is a text format for exchanging data. A JavaScript object is a live value inside a JavaScript program. Their notation overlaps, but treating them as identical causes common validation and security mistakes.
JSON.parse turns valid JSON text into a JavaScript value. JSON.stringify serializes supported JavaScript values into JSON text. Neither operation executes the input as program code.
The characters {"active":true} can be JSON text. After JSON.parse reads them, the result is a JavaScript object held in memory. Logging that object may display syntax that resembles the original, but it is no longer a text document.
A network response body and a .json file are text or bytes until parsed. JavaScript source can create an object directly without passing through JSON.
Object literals may use unquoted identifier keys, single-quoted strings, template strings, trailing commas, comments, undefined, functions, symbols, BigInt values, and computed properties. Standard JSON allows none of those features.
A pasted object literal often fails JSON validation because it was copied from source code rather than from a serialized request or response. Convert it deliberately instead of evaluating it.
JSON.stringify omits object properties whose values are undefined, functions, or symbols. In an array, unsupported values become null. BigInt throws unless the application supplies a custom representation. Date objects normally serialize through their toJSON behavior as strings.
Circular references cannot be represented by ordinary JSON because the format is a tree. A serializer needs a custom reference convention if objects point back to earlier objects.
Use JSON.parse for JSON received as text. Do not use eval or the Function constructor: they accept executable JavaScript and can turn untrusted input into code execution.
Parsing can still create data that is unsafe when later inserted into HTML, a database query, or a command. Validate structure and encode values for their eventual output context.
Confirm whether the value in front of you is text or already parsed. If it is text, validate the raw response before editing. If it is an object, inspect its types and use JSON.stringify to produce transferable text where supported.
When a console display differs from a network payload, trust the network inspector for the transferred representation. Developer tools may show an object lazily after its values have changed.
No. Only supported data can be serialized, and the textual syntax is stricter than an object literal.
No. Use JSON.parse so the input is treated as data rather than executable code.
Properties containing undefined, functions, or symbols are omitted; other unsupported structures may throw.