.JSON File Format – Strings

Grammar

string = quotation-mark *char quotation-mark

char   = unescaped /
         escape (
           %x22 /          ; "    quotation mark  U+0022
           %x5C /          ; \    reverse solidus U+005C
           %x2F /          ; /    solidus         U+002F
           %x62 /          ; b    backspace       U+0008
           %x66 /          ; f    form feed       U+000C
           %x6E /          ; n    line feed       U+000A
           %x72 /          ; r    carriage return U+000D
           %x74 /          ; t    tab             U+0009
           %x75 4HEXDIG )  ; uXXXX                U+XXXX

escape = %x5C              ; \

quotation-mark = %x22      ; "

unescaped = %x20-21 / %x23-5B / %x5D-10FFFF

What must be escaped

Every Unicode character may appear in a string as itself, except these, which must be escaped:

• the quotation mark, "
• the reverse solidus (backslash), \
• the control characters U+0000 to U+001F

A line break inside a string is therefore not allowed as a raw character: it has to be written \n or \r. Any other character may be escaped too, so a solidus can be written \/ or /, and é can be written as itself or as \u00E9. Characters from U+007F upward need no escape.

Escape sequences

A backslash followed by anything else is an error: there is no \v, \0, \x41 or \u{1F600} in JSON. The hex digits of \u may be in either case, so \u00e9 and \u00E9 mean the same.

Surrogate pairs

A \u escape holds one UTF-16 code unit, so a character above U+FFFF is written as two escapes in a row, a surrogate pair. RFC 8259’s example is the G clef, U+1D11E:

"\uD834\uDD1E"

The first half is a high surrogate in D800 to DBFF, the second a low surrogate in DC00 to DFFF. The character is 0x10000 + ((high − 0xD800) × 0x400) + (low − 0xDC00).

Unpaired surrogates

The grammar does not stop half a pair from appearing, so "\uDEAD" is grammatically valid, though it does not stand for a character. RFC 8259 section 8.2 says the behaviour of software that receives such values is unpredictable: some decode to a replacement character, some keep the code unit, and some fail.

Comparing strings

Programs often test member names for equality. RFC 8259 section 8.3 says implementations that decode a string to Unicode code units and compare those, code unit by code unit, will agree with one another in every case. An implementation that compares the raw text without converting its escapes will wrongly find "a\\b" and "a\u005Cb" to be different.

The same comparison decides whether two names in an object are the same name.

U+2028 and U+2029

LINE SEPARATOR and PARAGRAPH SEPARATOR need no escape in JSON and may appear as themselves in a string. In JavaScript before ES2019 they were not allowed in a string literal, so JSON containing them was not valid JavaScript. RFC 8259 notes this in its security section.