Two different things people mean by "validate"
"Validating JSON" can mean two genuinely different checks:
- Syntax validation — is this a well-formed JSON document at all? (Balanced brackets, proper quoting, no trailing commas.) This is what
JSON.parse()checks — it either succeeds or throws. - Schema validation — beyond being syntactically valid JSON, does it match an expected shape? (Required fields present, correct types, values within allowed ranges.) This needs a schema (see JSON Schema Tutorial) and a separate validation step — syntactically valid JSON can still fail schema validation if it's missing a required field or has the wrong type somewhere.
Most "JSON validators" online only do the first — confirm the document parses — which is useful but doesn't catch structural mismatches against what your application actually expects.
The privacy problem with "online" validators
This is the part most guides skip: many "paste your JSON here" validator websites process the input on their server, meaning your data — which might include API responses with real user data, credentials, internal config, or business logic — is transmitted to and potentially logged by a third party you have no visibility into. Before pasting anything sensitive into an online tool, check whether it explicitly states the processing happens client-side (in your browser, with no network request) — if that isn't stated clearly, assume it isn't true.
What a syntax check actually catches
- Mismatched or missing brackets/braces.
- Trailing commas.
- Single-quoted strings or unquoted keys.
- Invalid values (
undefined,NaN, leading zeros in numbers).
It will not catch: a missing field your application requires, a string where your app expects a number, or a value outside an acceptable range — those all need schema validation on top of syntax validation.
Common mistakes
- Assuming "it validated" means "it matches what my app expects." Syntax validity and schema conformance are separate checks — passing one doesn't imply the other.
- Pasting real API responses containing credentials or personal data into an unknown online tool without confirming it processes client-side.
- Not checking error output beyond "invalid." A good validator should point to the exact position of the problem, not just report failure.
FAQ
Is syntax-valid JSON guaranteed to work with my application?
No — your application likely expects specific fields, types, and structure beyond just "parseable JSON"; that requires schema validation, a separate and stricter check.
Is it safe to paste sensitive JSON into any online validator?
Only if the tool explicitly processes data client-side, in your browser, with no network transmission — assume otherwise unless clearly stated.
What's the difference between a formatter and a validator?
A formatter re-indents/reformats JSON for readability; a validator checks correctness — see JSON Formatter vs Validator for the full distinction.
Validate JSON syntax and structure entirely in your browser with the JSON Toolkit and JSON Schema Generator — nothing is ever uploaded.