# canonicalize

> JSON canonicalize function

Latest version **5.1.0** (published 2026-09-18) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install canonicalize
pnpm add canonicalize
yarn add canonicalize
bun add canonicalize
```

Provides the command `canonicalize`.

## Health

**Score 75/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 5.1.0 |
| Published | 2026-09-18 |
| First published | 2018-05-04 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=22 |
| Dependencies | 0 |
| Unpacked size | 23.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 63 |
| Maintainers | samuelerdtman |
| Keywords | json, canonical, canonicalize, signing, crypto |

## Links

- npm: https://www.npmjs.com/package/canonicalize
- Repository: https://github.com/erdtman/canonicalize
- Homepage: https://github.com/erdtman/canonicalize#readme
- Issues: https://github.com/erdtman/canonicalize/issues
- npm.io page: https://npm.io/package/canonicalize

## Alternatives

- [@mapbox/jsonlint-lines-primitives](https://npm.io/package/@mapbox/jsonlint-lines-primitives.md) — 5.3M weekly downloads
- [reftools](https://npm.io/package/reftools.md) — 3.5M weekly downloads
- [@hey-api/openapi-ts](https://npm.io/package/@hey-api/openapi-ts.md) — 3.5M weekly downloads
- [@mapbox/geojson-rewind](https://npm.io/package/@mapbox/geojson-rewind.md) — 2.4M weekly downloads
- [turbo-stream](https://npm.io/package/turbo-stream.md) — 1.7M weekly downloads

## Recent versions

- 5.1.0 (latest) — 2026-09-18
- 5.0.0 — 2026-09-08
- 4.0.0 — 2026-08-12
- 3.0.0 — 2026-04-08
- 2.1.0 — 2025-03-18
- 2.0.0 — 2023-04-02
- 1.0.8 — 2021-11-26
- 1.0.7 — 2021-11-26
- 1.0.6 — 2021-11-26
- 1.0.5 — 2020-11-18
- 1.0.4 — 2020-11-17
- 1.0.3 — 2020-08-05
- 1.0.2 — 2020-08-05
- 1.0.1 — 2019-02-27
- 1.0.0 — 2018-05-04

## README

[![CI](https://github.com/erdtman/canonicalize/actions/workflows/ci.yml/badge.svg)](https://github.com/erdtman/canonicalize/actions/workflows/ci.yml)
# canonicalize
JSON canonicalize function. Creates crypto safe predictable canonicalization of
JSON as defined by [RFC8785](https://tools.ietf.org/html/rfc8785).

TypeScript type definitions are included.

## Usage
### Normal Example
```js
import canonicalize from 'canonicalize';
const json = {
	"from_account": "543 232 625-3",
	"to_account": "321 567 636-4",
	"amount": 500,
	"currency": "USD"
}
console.log(canonicalize(json));
// output: {"amount":500,"currency":"USD","from_account":"543 232 625-3","to_account":"321 567 636-4"}
```
### Crazy Example
```js
import canonicalize from 'canonicalize';
const json = {
	"1": {"f": {"f":  "hi","F":  5} ,"\n":  56.0},
	"10": { },
	"":  "empty",
	"a": { },
	"111": [ {"e":  "yes","E":  "no" } ],
	"A": { }
}
console.log(canonicalize(json));
// output: {"":"empty","1":{"\n":56,"f":{"F":5,"f":"hi"}},"10":{},"111":[{"E":"no","e":"yes"}],"A":{},"a":{}}
```
### From CommonJS
Node 22.12 and later can `require()` an ES module. The module namespace is
returned as-is, so the function is reached through its `default` property:
```js
const canonicalize = require('canonicalize').default;
console.log(canonicalize({ b: 123, a: 'string' }));
// output: {"a":"string","b":123}
```
### Via CLI
The function can be executed directly using npx without explicit installation. This allows JSON files and arbitrary input to be canonicalized with standard input/output:
```bash
# Input from file
npx canonicalize < input.json > output.json

# Input from string
echo '{
	"from_account": "543 232 625-3",
	"to_account": "321 567 636-4",
	"amount": 500,
	"currency": "USD"
}' | npx canonicalize > simple-data.json

# Input from web API
curl --silent https://pokeapi.co/api/v2/pokemon/pikachu | npx canonicalize > pikachu.json
```
## Best practices for signature schemes
Here follows an example of how untrusted input can be processed and validated
before being treated as safe.

```js
import canonicalize from 'canonicalize';

// The received document is untrusted until validateSignature succeeds
const untrustedInputText = /* raw document as received */;
const inputSignature = /* detached signature as received */;

// Duplicate property names are resolved here, last-one-wins, by JSON.parse —
// before canonicalize() ever sees the data. To reject documents that carried
// duplicates on the wire, inspect untrustedInputText before this line.
const untrustedInputObject = JSON.parse(untrustedInputText);

const canonicalText = canonicalize(untrustedInputObject);
const isValid = validateSignature(canonicalText, inputSignature);

if (isValid) {
  // canonicalText is the only artifact the signature covers.
  //
  // untrustedInputObject is not that artifact. It was derived from
  // untrustedInputText and was never validated. It is parsable, but it is not
  // what was signed — do not treat the two as interchangeable.
  const validatedInput = JSON.parse(canonicalText);

  // From here on, operate on validatedInput.
}
```

Forwarding `untrustedInputText` downstream passes on bytes an attacker could
have altered while verification still succeeded; a consumer that resolves
duplicate property names first-one-wins will then read a different document
than the one you validated.

## Comparison with other implementations
[A reproducible comparison of the JavaScript JCS libraries on npm](https://erdtman.github.io/json-canonicalisation-comparison/)
checks each one against the RFC 8785 test vectors, 10,000 ES6
number-serialization vectors, and edge cases such as lone surrogates, alongside
benchmarks, maximum nesting depth, output validity and bundle size.

## Install
As a library:
```
npm install canonicalize --save
```
As a CLI tool:
```
npm install -g canonicalize
canonicalize < input.json > output.json
```
## Test
```
npm test
```

---
_Source: https://npm.io/package/canonicalize · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._