JSON (JavaScript Object Notation, pronounced /ˈdʒeɪsən/ or /ˈdʒeɪˌsɒn/) is an open standard file format and data interchange format that uses human-readable text to store and transmit data objects consisting of name–value pairs and arrays (or other serializable values).

It was derived from JavaScript, but many modern programming languages include code to generate and parse JSON-format data.

[4] RFC 8259, published in 2017, is the current version of the Internet Standard STD 90, and it remains consistent with ECMA-404.

[2] The ECMA and ISO/IEC standards describe only the allowed syntax, whereas the RFC covers some security and interoperability considerations.

[7] JSON grew out of a need for a real-time server-to-browser session communication protocol without using browser plugins such as Flash or Java applets, the dominant methods used in the early 2000s.

The cofounders agreed to build a system that used standard browser capabilities and provided an abstraction layer for Web developers to create stateful Web applications that had a persistent duplex connection to a Web server by holding two Hypertext Transfer Protocol (HTTP) connections open and recycling them before standard browser time-outs if no further data were exchanged.

[10] A precursor to the JSON libraries was used in a children's digital asset trading game project named Cartoon Orbit at Communities.com [citation needed] which used a browser side plug-in with a proprietary messaging format to manipulate DHTML elements.

Upon discovery of early Ajax capabilities, digiGroups, Noosh, and others used frames to pass information into the user browsers' visual field without refreshing a Web application's visual context, realizing real-time rich Web applications using only the standard HTTP, HTML, and JavaScript capabilities of Netscape 4.0.5+ and Internet Explorer 5+.

Four specific characters are considered whitespace for this purpose: space, horizontal tab, line feed, and carriage return.

In particular, the byte order mark must not be generated by a conforming implementation (though it may be accepted when parsing JSON).

For example, since no differentiation is made between integer and floating-point values, some implementations may treat 42, 42.0, and 4.2E+1 as the same number, while others may not.

In 2012, Douglas Crockford described his design decision thus: "I removed comments from JSON because I saw people were using them to hold parsing directives, a practice which would have destroyed interoperability.

[24] RFC 8259 describes certain aspects of JSON syntax that, while legal per the specifications, can cause interoperability problems.

[32] JSON-RPC is a remote procedure call (RPC) protocol built on JSON, as a replacement for XML-RPC or SOAP.

Typically, it renders new data from the server in response to user actions on that web page.

For example, what the user types into a search box, client-side code then sends to the server, which immediately responds with a drop-down list of matching database items.

Some relational databases, such as PostgreSQL and MySQL, have added support for native JSON data types.

This is not safe, due to certain valid JSON texts, specifically those containing U+2028 LINE SEPARATOR or U+2029 PARAGRAPH SEPARATOR, not being valid JavaScript code until JavaScript specifications were updated in 2019, and so older engines may not support it.

[34] To avoid the many pitfalls caused by executing arbitrary code from the Internet, a new function, JSON.parse(), was first added to the fifth edition of ECMAScript,[35] which as of 2017 is supported by all major browsers.

[17][18] Various JSON parser implementations have suffered from denial-of-service attack and mass assignment vulnerability.

[37][38] JSON is promoted as a low-overhead alternative to XML as both of these formats have widespread support for creation, reading, and decoding in the real-world situations where they are commonly used.

Ion is also a superset of JSON, with a wider range of primary types, annotations, comments, and allowing trailing commas.

@[\]^`{|}~, nor a space character, and cannot begin with -, ., or a numeric digit, whereas JSON keys can (even if quotation mark and backslash must be escaped).

[42][21] Support for comments and other features have been deemed useful, which has led to several nonstandard JSON supersets being created.

[47][48][49] There is also an unrelated project called CSON ("Cursive Script Object Notation") that is more syntactically similar to JSON.

[50] HOCON ("Human-Optimized Config Object Notation") is a format for human-readable data, and a superset of JSON.