JSON vs XML: Differences, Examples and Which to Use

For web APIs and app data, use JSON. It is shorter, it maps straight onto the objects and arrays every language has, and browsers parse it with JSON.parse. XML is still the better fit for documents that mix text and markup, for formats that combine vocabularies with namespaces, and for systems built on XML tooling such as XSD, XSLT and SOAP. If a partner or a standard requires XML, use XML at that boundary and convert.

The same data in both formats

JSON:

The same data from the JSON to XML converter:

Four differences show up in that one example:

• XML needs exactly one root element, so the converter wraps everything in .
• XML has no arrays. The list becomes repeated elements.
• XML content is text. 1 and true are just characters unless a schema says otherwise, while JSON keeps them as a number and a boolean.
• XML has no null. An empty element is one convention, and every converter picks its own.

The differences in one table

Where JSON wins

• APIs and web apps. A JSON object is already the shape your code wants. There is no DOM to walk.
• Types without a schema. A number stays a number and true stays a boolean, so a consumer does not need a schema to read values correctly.
• Less to send and less to write. No closing tags, no attribute versus element decisions, no namespace prefixes.
• Tooling for typed code. Validation with JSON Schema and querying with JSONPath cover most of what XSD and XPath do for data.

Where XML still wins

• Documents. XML handles text with markup inside it:

  Press Ctrl to copy

  . JSON has no clean way to say that. SVG, RSS and Atom feeds, and the Office formats DOCX and XLSX (zipped XML) are all XML.
• Namespaces. One XML document can mix vocabularies without name clashes. JSON has nothing like it.
• Established standards. SOAP web services and SAML single sign-on are XML. You meet them in enterprise and government integrations.
• Comments in config. XML config files can carry comments. Plain JSON cannot, though JSONC and JSON5 add them.

A security difference

XML parsers can resolve external entities, which is the XXE class of attack: a crafted document reads local files or makes the server send requests. OWASP's XXE prevention cheat sheet says to disable DTDs whenever possible, and otherwise to disable external entity resolution. JSON has no entity mechanism, so this whole class does not apply. If you parse XML from outside your system, check your parser's settings.

What about YAML and CSV?

YAML and JSON hold the same kinds of data. YAML is easier to read and write by hand and allows comments, which is why it is popular for config. The YAML vs JSON comparison goes through the trade-offs. CSV is different: it is a flat table of text with no nesting and no types, so it suits spreadsheets and bulk loads. See JSON vs CSV.

Converting between them

Use the JSON to XML converter and the XML to JSON converter. Both run in your browser. Conversion is lossy in both directions, because each format has things the other lacks. The ones that bite:

• an XML element that appears once looks like a single value, but twice looks like an array
• XML attributes need a naming convention in JSON, commonly keys prefixed with @
• every XML value arrives as a string unless the converter guesses types

The JSON to XML guide and the XML to JSON guide cover each of these.

FAQ

Is JSON better than XML?

For APIs and app data, usually yes: it is shorter and maps directly onto program data. For documents with markup, namespaces or an XML-based standard, XML is the better tool.

Is JSON faster than XML?

There is no single answer, because it depends on the parser and the data. For the same data JSON is usually smaller, so there is less to send and less to parse.

Can JSON have attributes like XML?

No. JSON only has keys and values. Converters represent XML attributes with a naming convention, such as a key "@id" inside the element's object.

Is XML outdated?

No. It is less common in new web APIs, but it is the format behind SVG, RSS, DOCX and XLSX, SOAP and SAML, and it is not going away.