The History of JSON: From 2000 to Industry Standard

Douglas Crockford and the origin

In the early 2000s, Douglas Crockford, a veteran JavaScript developer, grew frustrated with XML, the dominant data format of the era. XML was verbose, hard to parse in browsers, and overkill for simple server-to-client data transfer.

Working at State Software, Crockford realized that JavaScript's object-literal syntax already worked as a data format: compact, human-readable, and understood by every browser. He named it JSON (JavaScript Object Notation) and registered json.org in 2002 to publish the specification.

The Web 2.0 adoption wave

JSON's big break came with the Web 2.0 movement (2005–2006). AJAX-powered apps needed lightweight server responses, and developers reached for JSON instead of XML. Yahoo adopted it early and shipped JSON in several of its web services.

For a time, developers parsed JSON with eval(), which ran fast but could execute arbitrary code. ECMAScript 3.1 (which became ES5 in 2009) added a native, safe JSON.parse(), removed that risk, and made JSON part of the platform.

Becoming a standard

Ecma formalized JSON as the ECMA-404 standard in 2013, and the IETF published it as RFC 7159 in 2014 (revised as RFC 8259 in 2017). Those documents made JSON a language-independent standard instead of a JavaScript feature.

From there, adoption spread everywhere. REST APIs defaulted to JSON. NoSQL databases like MongoDB stored documents as JSON (BSON). Configuration files, JWT authentication tokens, and cloud-native tooling standardized on JSON or its superset, YAML.

The eval() era and JSONP

Before native parsing existed, developers fetched cross-domain data with JSONP: wrap the JSON response in a callback function name and load it as a <script> tag, sidestepping the same-origin policy. It worked everywhere, but the calling page had to trust the data provider completely, since a script tag executes whatever it receives.

That trust problem aged badly. As APIs multiplied, attackers used JSONP as an injection vector, and the industry moved on: CORS standardized proper cross-origin requests, and you'll meet JSONP today only in legacy codebases.

The modern JSON ecosystem

JSON grew beyond a wire format. JSON Schema became a validation ecosystem with its own draft process, powering API contracts and code generators. Variants appeared for specific niches: JSON5 relaxes the syntax for human-edited files, BSON backs MongoDB's storage with a binary layout, NDJSON (newline-delimited JSON) streams records line by line for logs and bulk transfers, and JSONC (JSON with comments) lives on in configuration files like VS Code's settings.

The format's governance settled too: RFC 8259 (2017) is the current Internet Standard, alongside ECMA-404. Crockford's original site, json.org, stays online as a spec reference and a piece of web history.

Why JSON beat XML

JSON runs roughly 30–40% smaller than equivalent XML (no closing tags, no attributes), maps to native data structures in every language, and parses far faster. XML keeps its niches (document markup, SOAP, config with schemas), but JSON dominates data interchange.