How to Check If a String Is Valid JSON in PHP

By the end of this page, you will understand how JSON validation works in PHP, why calling json_decode() multiple times is wasteful, and how to correctly check JSON using json_last_error() or exceptions. You will also see practical examples, common mistakes, and a small project that turns this idea into reusable validation code.

JSON validation in PHP is usually done by trying to decode the string and then checking whether decoding succeeded.

The key idea is:

• PHP does not provide a separate "is this JSON?" parser that is faster than decoding.
• In practice, you validate JSON by calling json_decode().
• After decoding, you inspect whether an error occurred.

A common beginner mistake is to decide based on the decoded value's type, such as checking is_object() or is_array(). That seems reasonable at first, but valid JSON is not limited to objects and arrays.

These are all valid JSON values:

{"name":"Ada"}

[1, 2, 3]

"hello"

123

true

Think of json_decode() like a language translator.

• You hand it a string.
• It tries to translate that string from JSON into a PHP value.
• If translation succeeds, the JSON was valid.
• If translation fails, PHP records the reason.

The important part is that you do not ask, "Did I get an object or array?" Instead, you ask, "Did the translator report an error?"

That mental model helps because JSON can translate into many different PHP value types, not just arrays and objects.

The standard pattern in PHP is:

function isJson(string $string): bool
{
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

Example

var_dump(isJson('{"name":"Ada"}')); // true
var_dump(isJson('[1,2,3]'));           // true
var_dump(isJson('"hello"'));          // true
var_dump(isJson('123'));              // true
var_dump(isJson('not json'));         // false

Why this is better

• json_decode() is called only once.
• It works for all valid JSON values.

Consider this function:

function isJson(string $string): bool
{
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

Now trace this input:

$input = '{"active":true}';
$result = isJson($input);

Step by step

1. $input stores the string {"active":true}.
2. isJson($input) is called.
3. Inside the function, json_decode($string) tries to parse the string.
4. PHP successfully understands the JSON.
5. json_last_error() returns JSON_ERROR_NONE.
6. The comparison becomes true.
7. The function returns true.

Here are common situations where JSON validation appears in real PHP applications:

API request handling

A server receives JSON in a request body and must reject malformed payloads.

$body = file_get_contents('php://input');

if (!isJson($body)) {
    http_response_code(400);
    echo 'Invalid JSON';
    exit;
}

Reading configuration from a file

$configText = file_get_contents('config.json');

if (!isJson($configText)) {
    die('Configuration file is not valid JSON');
}

Importing queue messages

Workers often consume JSON messages from queues such as Redis, RabbitMQ, or SQS.

$message = '{"task":"resize-image","id":42}';

if (isJson($message)) {
    $data = json_decode(, );
}

In real projects, developers usually do more than just "check if it is JSON."

Decode once and keep the result

If you need the decoded data, avoid decoding once for validation and again for usage.

$data = json_decode($input, true);

if (json_last_error() !== JSON_ERROR_NONE) {
    throw new InvalidArgumentException('Invalid JSON: ' . json_last_error_msg());
}

This pattern is better because parsing happens only once.

Guard clauses

A common pattern is to fail early when input is invalid.

$data = json_decode($payload, true);
if (json_last_error() !== JSON_ERROR_NONE) {
    return ['error' => 'Invalid JSON'];
}

Validation after decoding

Valid JSON does not mean valid business data.

$data = json_decode($payload, );

 (() !== JSON_ERROR_NONE) {
      ();
}

 (!([])) {
      ();
}

1. Decoding multiple times

Broken approach:

function isJson($string) {
    return is_object(json_decode($string)) || is_array(json_decode($string));
}

Problem:

• json_decode() runs twice.
• Parsing JSON is the expensive part.
• Repeating it wastes time.

Fix:

function isJson(string $string): bool
{
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

2. Assuming valid JSON must be an object or array

Broken assumption:

var_dump(isJson('123'));     
(()); 

// Check if a string is valid JSON
function isJson(string $string): bool
{
    json_decode($string);
    return json_last_error() === JSON_ERROR_NONE;
}

// Decode and throw on invalid JSON
$data = json_decode($json, true, 512, JSON_THROW_ON_ERROR);

Rules to remember

• json_decode() is the normal way to validate JSON in PHP.
• Call it once if possible.
• Use json_last_error() or JSON_THROW_ON_ERROR.
• Valid JSON can be:
  • object
  • array
  • string
  • number
  • boolean
  • null
• Do not assume only arrays or objects are valid.
• json_decode('null') returns null, but it is still valid JSON.

Useful helpers

Is json_decode() the fastest way to check JSON in PHP?

Yes, in practice this is the standard and efficient way. PHP validates JSON by parsing it, so decoding is the normal approach.

Why is calling json_decode() twice a problem?

Because parsing happens twice. That adds unnecessary work and gives no benefit.

Why does checking is_array() or is_object() reject some valid JSON?

Because valid JSON can also be a string, number, boolean, or null, not just an object or array.

How do I get the reason JSON parsing failed?

Use json_last_error_msg() after json_decode().

Should I use json_last_error() or JSON_THROW_ON_ERROR?

For simple scripts, json_last_error() is fine. For modern applications, JSON_THROW_ON_ERROR is often cleaner.

Is null valid JSON in PHP?

Yes. The string null is valid JSON.

How can I check that JSON is specifically an object or array?

• json_encode() — the opposite operation, converting PHP values into JSON.
• json_decode() — the core function used to parse and validate JSON.
• json_last_error() — used to detect whether JSON parsing failed.
• json_last_error_msg() — helps explain why parsing failed.
• JSON_THROW_ON_ERROR — a modern way to handle JSON parsing errors with exceptions.
• associative arrays in PHP — important when decoding JSON objects with true.
• input validation — valid JSON is only the first step before checking required fields and types.
• exception handling in PHP — useful when working with JsonException in modern code.