QuietJSON
Semantic Warning & Data Loss Risk

Duplicate Keys in JSON: Why They Are Dangerous

Most JSON formatters quietly swallow duplicate object keys. But in production APIs, duplicate keys cause subtle, dangerous data corruption bugs because different programming languages interpret them inconsistently.

Warning: Duplicate key "email" detected. This key was already defined at line 2, column 3. Parsers may inconsistently overwrite or discard duplicate values.

The Inconsistent Parser Trap

Consider this simple JSON object:

{
  "role": "guest",
  "role": "admin"
}

What role does this user have? The answer depends entirely on what software reads it:

  • JavaScript (V8 / Node.js): Keeps the last key (admin).
  • Python (json.loads): Keeps the last key (admin).
  • Go (encoding/json): Keeps the first key or overwrites depending on struct field unmarshaling rules.
  • Strict parsers / Linters: Reject the document as invalid.

This inconsistency is an invitation for security vulnerabilities: an API gateway might validate authentication using the first key while your backend executes database operations using the second!

How to Fix Duplicate Keys

If multiple values are intended for a single property, use an array instead of repeating the key:

Bad (Duplicate Keys):
{
  "phone": "555-0100",
  "phone": "555-0199"
}
Good (Array of Values):
{
  "phoneNumbers": [
    "555-0100",
    "555-0199"
  ]
}

Frequently Asked Questions

Is duplicate key syntax allowed in JSON by RFC standards?

The JSON specification (RFC 8259 Section 4) explicitly states: 'The names within an object SHOULD be unique.' While grammars technically parse duplicate keys without syntax errors, the RFC warns that software receiving duplicate keys exhibits unpredictable behavior.

What does JavaScript JSON.parse do when duplicate keys exist?

JavaScript engines (V8, JavaScriptCore) follow the 'last-one-wins' rule: later key definitions silently overwrite earlier values. For example, JSON.parse('{"id": 1, "id": 2}') yields {"id": 2}, completely destroying the original id: 1 without any error or warning.

How does QuietJSON detect duplicate keys?

QuietJSON builds a structured AST using jsonc-parser that tracks property scopes. It flags duplicate property names and reports the exact line and column numbers of both the first and duplicate occurrences.

Detect duplicate keys in your JSON

QuietJSON alerts you with precise line and column numbers before you commit or deploy.

Check Your JSON →