Data exchange · foundation
Serialization and JSON
Serialization converts in-memory data into a transportable or storable representation; JSON represents objects, arrays, strings, numbers, booleans, and null as Unicode text with a defined grammar.
Why it matters
A wire format crosses language, version, and trust boundaries, so type loss, number ranges, schema evolution, validation, and untrusted input handling affect correctness and security.
Mental model
How to reason about serialization and json
Encoding projects a richer runtime object into the smaller set of values the format can express. Decoding reconstructs data, not the original behavior or every original type distinction.
Analogy
A shipping manifest records standardized fields about an object, not the object itself. The receiver needs shared rules to rebuild the intended meaning from those fields.
Examples
See the boundary, not just the happy path
Worked example · Explicit timestamp
{"createdAt": "2026-07-20T12:30:00Z"}JSON has no date type, so the API chooses a string convention and clients parse it according to the contract.
Worked example · Evolve additively
add optional field "displayName" while retaining existing fieldsReaders that ignore unknown fields can remain compatible, provided the new field does not silently change old semantics.
Useful contrast · Large integer interoperability
{"id": 9007199254740993}JSON's grammar permits the number, but common IEEE-754 binary64 consumers cannot represent it exactly; a string may be safer for identifiers.
Common mistakes
Misconceptions to remove early
Deserializing without validation
Syntactically valid JSON can have missing fields, wrong ranges, excessive depth, or hostile content. Validate size and schema at the trust boundary.
Assuming object member order matters
JSON objects are unordered by the data model. Protocols that sign or compare bytes need an explicit canonicalization scheme rather than incidental encoder order.
Quick check
Can you predict the result?
1. Which value is not a native JSON data type?
- • A date-time value
- • A string
- • An array
2. Why might an API encode a large numeric identifier as a string?
Keep building