Whether you're interviewing for a frontend, backend, or full-stack role, JSON questions come up in almost every technical screen. These 30 questions cover everything from basic syntax to advanced topics like streaming, schema validation, and security — with the kind of precise answers that impress interviewers.

Basics (Q1–Q8)

Q1.What is JSON and what does the acronym stand for?

JSON stands for JavaScript Object Notation. It is a lightweight, text-based data interchange format based on a subset of JavaScript syntax. It is language-independent and widely used for transmitting data between a server and a client in web applications.

Q2.What data types does JSON support?

JSON supports exactly six types: string (double-quoted Unicode), number (integer or floating-point, no NaN/Infinity), boolean (true or false), null, object (unordered key-value pairs, keys must be strings), and array (ordered list). It does not natively support dates, undefined, or functions.

Q3.What is the difference between JSON and JavaScript objects?

JSON is a string format; a JavaScript object is an in-memory data structure. Key differences: JSON keys must be double-quoted strings; JS objects can have unquoted or single-quoted keys. JSON does not support undefined, functions, or comments. JSON.parse() converts a JSON string into a JS object; JSON.stringify() does the reverse.

Q4.Is the following valid JSON? Why or why not? <code>{`{'name': 'Alice'}`}</code>

No. JSON requires double quotes for both keys and string values. Single quotes are invalid per RFC 8259. The correct JSON is {"name": "Alice"}.

Q5.Can JSON objects have duplicate keys?

The JSON spec (RFC 8259) says duplicate keys should be unique but does not make them a hard error. Parser behaviour is undefined — some keep the last value, some keep the first, some throw. In practice, treat duplicate keys as a bug; tools like our JSON Validator will flag them.

Q6.What is the maximum depth or size limit for JSON?

The JSON spec defines no limit. Real constraints come from parsers: most stack-based recursive parsers throw on deeply nested objects (~500-1000 levels). Browser JSON.parse handles very large files well, but parsing a 50 MB JSON in one shot will block the main thread. Stream parsers (e.g. jsonstream in Node.js) handle arbitrarily large files.

Q7.How do you handle JSON with comments?

Standard JSON does not support comments. Workarounds: (1) Use a superset like JSON5 or JSONC (used in tsconfig.json) which allow // and /* */. (2) Strip comments before parsing with a library. (3) Add a "_comment" key as a convention. Production APIs should use standard JSON without comments.

Q8.What is JSON Lines (JSONL) and when would you use it?

JSON Lines (also called NDJSON) stores one JSON object per line with no surrounding array. It is ideal for streaming and log processing: you can append a line without reading the whole file, and stream-parse line by line without loading everything into memory. LLM training datasets, Elasticsearch bulk imports, and application log pipelines commonly use JSONL.

Parsing & Serialization (Q9–Q14)

Q9.What does JSON.parse() do when it receives invalid JSON?

It throws a SyntaxError synchronously. Always wrap JSON.parse() in a try/catch block when parsing untrusted input. The error message includes the character position of the first syntax problem, which can help you locate the issue.

Q10.What is the second argument to JSON.stringify() and JSON.parse()?

JSON.stringify(value, replacer, space) — the replacer is a function or array that filters/transforms keys; space is an indent string or number for pretty-printing. JSON.parse(text, reviver) — the reviver is a function called for each key-value pair, letting you transform values (e.g., parse ISO date strings into Date objects).

Q11.How do you serialize a JavaScript Date to JSON?

JSON.stringify calls .toISOString() on Date objects, producing an ISO 8601 string like "2026-10-14T08:00:00.000Z". The string round-trips as a string, not a Date — use a reviver in JSON.parse to convert it back, or use a library like date-fns.

Q12.What happens to undefined, functions, and Symbols in JSON.stringify()?

All three are silently dropped. In an object, the key-value pair is omitted. In an array, the slot is replaced with null. If the top-level value is undefined/function/Symbol, stringify returns undefined (not a string). This is a common source of bugs — always verify round-trip behaviour.

Q13.Explain circular reference errors in JSON serialization.

If object A references object B which references A (directly or transitively), JSON.stringify throws TypeError: Converting circular structure to JSON. Solutions: (1) use a replacer that tracks seen objects and skips them; (2) use a library like flatted or json-stringify-safe; (3) restructure the data to remove the cycle.

Q14.How would you deep-clone a JavaScript object using JSON?

const clone = JSON.parse(JSON.stringify(obj)). It's fast and simple but lossy: drops undefined, functions, Symbols, Date objects become strings, Map/Set become {}/[]. Use structuredClone() (ES2022+) for a lossless deep clone.

JSON Schema & Validation (Q15–Q19)

Q15.What is JSON Schema?

JSON Schema is a vocabulary for annotating and validating JSON documents. It defines structure (required keys, types, formats), constraints (min/max, pattern), and relationships. Schema files are themselves JSON documents. Common validators: ajv (Node.js), jsonschema (Python). You can validate live in our JSON Schema Validator.

Q16.What is the difference between JSON Schema draft-07 and draft-2020-12?

Draft-2020-12 introduces: $dynamicRef/$dynamicAnchor for recursive schemas, prefixItems (replaces array-specific items), unevaluatedItems/unevaluatedProperties for strict validation, and $vocabulary for dialect declaration. Many production codebases still use draft-07 due to tooling support; ajv defaults to draft-2020-12 in v8+.

Q17.What is additionalProperties in JSON Schema?

additionalProperties: false rejects any key not listed in properties or patternProperties. It's used to enforce strict contracts (no extra fields). additionalProperties: {type: "string"} allows extra keys but constrains their type. Omitting it (or setting true) allows anything.

Q18.How do you validate that a JSON field matches a specific date format?

Use {"type": "string", "format": "date"} for ISO 8601 dates (YYYY-MM-DD), or "date-time" for full timestamps. Format validation is optional in the spec — validators must be told to enforce it (in ajv: {formats: require('ajv-formats')}). For custom patterns use "pattern": "^\\d4-\\d2-\\d2$".

Q19.What is the oneOf / anyOf / allOf keyword?

allOf: value must satisfy all listed schemas (AND). anyOf: value must satisfy at least one (OR). oneOf: value must satisfy exactly one (XOR — useful for discriminated unions). not: value must NOT satisfy the schema. These compose schemas and are key to modelling polymorphic JSON.

APIs, REST & Performance (Q20–Q25)

Q20.What Content-Type header should a REST API return for JSON?

Content-Type: application/json; charset=utf-8. Using text/json or text/plain is non-standard and may cause browsers to misinterpret the body. For JSON Patch operations use application/json-patch+json; for JSON Merge Patch use application/merge-patch+json.

Q21.What is JSON Patch (RFC 6902) and when would you use it?

JSON Patch is a format for describing changes to a JSON document as a list of operations: add, remove, replace, move, copy, test. You use it in REST APIs to send partial updates (PATCH method) without transmitting the entire resource — reducing bandwidth and enabling optimistic concurrency.

Q22.How do you handle large JSON payloads in production?

Strategies: (1) Paginate API responses instead of returning all records. (2) Use sparse fieldsets (?fields=id,name) to trim payload. (3) Compress with gzip/brotli — most JSON compresses 70-90%. (4) Use streaming JSON parsers on the server to avoid loading the whole document into memory. (5) Cache parsed results; avoid re-parsing on every request.

Q23.What is JSONP and is it still relevant?

JSONP (JSON with Padding) wrapped JSON in a callback function to work around same-origin policy: callback({"key":"value"}). It required script tag injection. Modern APIs use CORS headers instead, which are more secure, type-safe, and support all HTTP methods. JSONP is legacy and should not be used in new code.

Q24.Explain JSON Web Tokens (JWT) structure.

A JWT has three Base64URL-encoded parts separated by dots: header.payload.signature. The header identifies the algorithm (e.g. HS256), the payload carries claims (sub, exp, custom fields), and the signature verifies integrity. The payload is not encrypted by default — anyone can base64-decode it. Never put secrets in a JWT payload unless using JWE (JSON Web Encryption).

Q25.What is the difference between JSON and BSON?

BSON (Binary JSON) is MongoDB's binary-encoded serialization of JSON-like documents. It adds types not in JSON: Date, ObjectId, BinData, Decimal128, Regex. BSON is faster to parse and supports larger documents (up to 16 MB) and binary data natively. The trade-off: it's not human-readable and requires a BSON library.

Security (Q26–Q28)

Q26.What JSON-related security vulnerabilities should you know about?

1. JSON Injection: embedding malicious JSON into untrusted fields to break the outer document. 2. Prototype Pollution: in JS parsers that merge objects, __proto__ keys can overwrite Object.prototype. Use Object.create(null) or strip dangerous keys. 3. Billion Laughs (DoS): deeply nested or massive arrays crash naive parsers. Always set a size/depth limit. 4. Sensitive Data Exposure: logging JSON that contains passwords or tokens.

Q27.What is prototype pollution and how does JSON cause it?

Prototype pollution occurs when an attacker sets __proto__ or constructor.prototype via a merged JSON object, adding properties to all objects globally. Example: JSON.parse('{"__proto__": {"isAdmin": true}}') — if naively merged into another object, all objects gain isAdmin: true. Mitigations: use a safe merge library, validate schema strictly, or use Object.create(null) for parsed data.

Q28.Should you use eval() to parse JSON? Why or why not?

Never. eval('(' + jsonString + ')') executes arbitrary JavaScript, making it a critical XSS vector. Always use JSON.parse(), which is sandboxed — it only accepts valid JSON and cannot execute code. eval was a common pattern before 2009 (IE7 era); all modern engines provide fast native JSON.parse.

Advanced (Q29–Q30)

Q29.How do LLMs like GPT-4 produce JSON reliably?

Through grammar-constrained decoding: the model's output token probabilities are masked so only tokens forming valid JSON are allowed. OpenAI calls this response_format: {type: "json_schema"} with strict: true. Anthropic uses tool-use schemas; Gemini uses response_schema. At each decoding step the sampler checks the partial output against a JSON grammar and zeros out illegal continuations. See our LLM Structured Outputs guide for practical examples.

Q30.What is JSON:API and how does it differ from plain REST JSON?

JSON:API (jsonapi.org) is a specification for REST APIs that defines a standard document structure: data (primary resources), included (side-loaded related resources), links (pagination, self), meta, and errors. It enables compound documents (fetching a post and its comments in one request), sparse fieldsets, and relationship links. Plain REST JSON has no standard envelope — each API invents its own.

Practice tip

Before your interview, load a sample JSON file into the JSON Formatter and the JSON Schema Validator so you can speak from hands-on experience.