JSON Libraries in 2026: Validation Is the Whole Market

JSON is the one format nobody argues about, which makes its library market unusually clean to read: almost every package here is a component inside somebody else's tool rather than a choice a developer makes.

Source: the npm downloads API. Window 2024-10-01 to 2026-10-10, pulled 2026-10-12, first 30 days against last 30. Change the trailing package name to check any figure.

The table

Installs, not users, and not bytes moved. Every figure is my own pull.

One validator owns the category

ajv at 1.749B monthly installs is not "popular"; it is infrastructure. It grew +252% while being, by reputation, the least fun part of anybody's stack. The reason is structural: JSON Schema is how OpenAPI, Fastify, Ajv-based config loaders, and a large share of TypeScript-adjacent codegen express "what shape is this input," so installing a framework installs a validator.

fast-json-stringify at +621% and safe-stable-stringify at +310% are the other two rows I'd point at. Both are serialisation, both are ~300–600% growth, and neither is a thing a developer picks after deliberation. They get pulled in by log pipelines, cache layers, and anything that has to produce a stable string for a hash or an ETag. safe-stable-stringify's entire feature is key ordering, which is exactly the requirement you discover the first time a content hash changes for no reason.

@msgpack/msgpack at +17.8× is the fastest grower and the smallest base (1.298M → 23.07M). Binary encoders grow when wire cost starts mattering — usually a signal about message volume, not about JSON falling out of favour.

The rows that break the tidy story

json5 at 1.082B. If JSON had won absolutely, nothing that adds comments back would be installed a billion times a month. json5 and its cousins exist because configuration is JSON-shaped but humans write it. That is a permanent demand created by JSON's success, not a rejection of it.

flatted at 715.9M. Its job is cycles — the one thing JSON.stringify refuses. 715.9M installs a month says a lot of systems are passing object graphs with shared or recursive references across a boundary that demands text: state managers, RPC layers, worker boundaries. superjson (+518%) and devalue are the same argument with more features: Dates, Maps, Sets, undefined. The interesting quantity is not how big JSON is, it is how much of what programs actually hold isn't JSON and has to be forced into it.

bson grew the least (+134%) despite MongoDB's footprint. Consistent with it being a driver-internal dependency in a mature product rather than a growth market.

Choosing

• Validating external input: ajv. Compiles schemas to functions, which is why it is fast enough to sit in a request path.
• Config that must stay human-editable: json5, or JSONC via your loader. Do not fight this with a linter.
• Hashing or caching: safe-stable-stringify. Non-deterministic key order is a bug you will not see in review.
• Throughput-bound serialisation: fast-json-stringify. Measure it against JSON.stringify on your own payloads before believing any benchmark, including mine — I have not benchmarked it here.
• Crossing a boundary with Dates/Maps/cycles: devalue or superjson rather than hand-rolled toJSON patches.

What this table cannot tell you

• These are nested dependencies, not decisions. ajv's 1.749B mostly represents other packages' installs. Any claim of the form "N developers chose Ajv" is unsupported by this data.
• Encoders and text JSON are not competing for the same slot. bson and @msgpack/msgpack grow alongside JSON, not against it.
• Downloads are not volume. One CI runner re-installing a monorepo contributes dozens of events and zero bytes of JSON.

Related

• JSON tools compared — formatters and differs
• JSON trends 2026 — adoption over the same window
• JSON best practices — schema, precision, and encoding traps