JSON Canonicalization

JSON canonicalization turns semantically equivalent JSON data into one deterministic byte sequence. It is useful before hashing, signing, comparing, or using JSON as an identity key. Ordinary JSON serialization is not enough: object-member order, whitespace, escaping, and number formatting can differ without changing the data model.

JSON Canonicalization Scheme #

RFC 8785 defines the JSON Canonicalization Scheme (JCS). It uses the ECMAScript JSON serialization rules, serializes object properties in lexicographic order of UTF-16 code units, emits no insignificant whitespace, and requires valid I-JSON input.

Canonicalize parsed data, not arbitrary text. Reject duplicate object member names, unsupported number values such as NaN and infinity, and input that cannot be represented under the chosen data model. Numeric precision matters: an implementation that parses every number as a binary floating-point value can silently alter large integers.

Hashing and Signing #

Sign the canonical UTF-8 bytes, not the original JSON text:

1. validate and parse the JSON under a defined profile;
2. serialize it with a standards-compliant canonicalizer;
3. hash or sign those exact bytes; and
4. record the canonicalization and signature algorithms with the signature.

Canonicalization does not make untrusted JSON safe, prove schema validity, or replace authenticated transport. It only supplies stable bytes for an agreed data value. Both producer and verifier must use the same canonicalization rules.