Unquoted property names in JSON

In JSON a key is a string, so it needs double quotes, then a colon. There is no bare-identifier form, so {name: "Ada"} is invalid however ordinary the key looks.

How the message appears

The same fault, worded by different engines. V8 (Chrome, Node, Edge) changed its format around Chrome 109, so older and newer runtimes disagree about the same document.

  • SyntaxError: Expected property name or '}' in JSON at position 2
  • SyntaxError: JSON.parse: expected double-quoted property name at line 2 column 3 of the JSON data

The fix

Wrap every property name in double quotes. Values keep their own rules: strings quoted, numbers and booleans bare.

Fails to parse
{
  name: "Ada",
  id: 7
}
Parses
{
  "name": "Ada",
  "id": 7
}

The example travels in the URL fragment, which browsers never send to a server.

What causes it

A JavaScript object literal used as JSON

JavaScript allows unquoted keys when they are valid identifiers, so {name: "Ada"} is fine in a .js file and invalid in a .json one. The two syntaxes look similar enough that this is easy to miss in review.

YAML or an env-style file being parsed as JSON

If the whole document uses key: value with no braces or quotes, it is not malformed JSON: it is a different format, and it needs a YAML parser rather than a fix.

Hand-written fixtures

Test fixtures typed by hand rather than generated. JSON.stringify always quotes keys, so anything it produces is safe.

Worth knowing

  • JSON5 permits unquoted keys. If you control the reader and genuinely want that, use a JSON5 parser rather than hand-relaxing JSON.
  • Keys are strings, so {"1": "a"} is legal and {1: "a"} is not, even though both work as JavaScript.

Written by Vishnu Shankar.

Your JSON and text are processed entirely in your browser and are never sent anywhere. To understand how the site is used we record each page view (the page, the referrer and an approximate location from your IP address) and keep it for 90 days. Nothing is stored on your device unless you choose it. Accept to also store a device identifier here and record your browser and device characteristics, which is what lets a return visit be told from a new one. Decline and nothing is sent at all. We respect Do Not Track. See our privacy policy.