How to use the json canonicalizer
- Paste the JSON.
- Read the canonical form in the result box.
- Check the byte count and the SHA-256 hash under the box.
- Copy the canonical JSON or download it as a file.
Formula
Object members are sorted by the UTF-16 code units of their names
There is no white space between tokens
Strings use the shortest escapes: \n, \t, \", \\ and \u00XX in lower case for other control characters
Numbers are written as JavaScript writes them: 1.0 becomes 1 and 1E30 becomes 1e+30
This is the JSON Canonicalization Scheme of RFC 8785. The hash is taken over the UTF-8 bytes of the canonical text.
The example from RFC 8785
The input has the members numbers, string and literals. The canonical form puts literals first, then numbers, then string: the numbers become 333333333.3333333, 1e+30, 4.5, 0.002 and 1e-27, and the string keeps the euro sign as it is and writes the control character as \u000f.
The canonical text is 118 bytes long and its SHA-256 hash begins 2d5e01a3. A simple pair such as {"b":1,"a":[]} becomes {"a":[],"b":1}, and the list [1.0, 1e21, -0] becomes [1,1e+21,0].
Why a canonical form is needed
Two JSON texts can mean the same thing and still be different byte by byte: the members may be in another order, numbers may be written 1.0 or 1, and strings may use different escapes. A hash or a signature is taken over bytes, so the same data would give different hashes. A canonical form turns every equal document into one exact text, so hashes and signatures can be compared.
The scheme in RFC 8785 is chosen so that any program with JavaScript style number formatting can produce it, which is why the number rules follow that language.
Points to watch
Numbers are read as 64-bit floating point values, so integers above 9,007,199,254,740,991 lose precision, as the scheme expects. Duplicate member names are not reported, because the last one wins when the text is read. The hash is for convenience and is not a signature. See the JSON Formatter and Validator to check syntax, the Hash Format Identifier to recognize a hash, the JSON Patch Applier to change the document first, and the UUID Generator for identifiers.
Assumptions and limits
- The input is a single valid JSON value.
- The hash is SHA-256 over the UTF-8 bytes of the canonical text.
- The sample is the example from the standard. Use your own JSON.
- Everything runs in your browser and nothing is uploaded.
Frequently asked questions
Why are the keys sorted by UTF-16 units?
The standard defines the order that way so that every implementation agrees, including for characters outside the basic plane, which sort by their surrogate pairs.
What happens to -0?
It is written as 0, as JavaScript writes it, so 0 and -0 give the same canonical text.
Does it change the meaning of my data?
No, apart from the precision of very large numbers. Keys are reordered and white space is removed, but every value stays the same.
Can I use the hash as a signature?
No. A hash shows that two texts match. A signature also needs a secret key, which this tool does not use.