Unexpected Token in JSON at Position 0: Causes and Fixes

“Unexpected token in JSON at position 0” means the first character of the value is not valid where a JSON value should begin. The fastest fix is to inspect the exact raw string passed to JSON.parse(). Do not retry the same parse or immediately replace characters.

In API code, the input is often not JSON at all. A leading < usually means an HTML error, login, or proxy page was returned. A leading u commonly means undefined reached the parser. An empty or truncated response more often produces an “Unexpected end of JSON input” message.

JavaScript engines vary in their exact error wording, but the reported character is still useful. Check it against the raw input before looking for a missing bracket deeper in the payload.

Preserve the response as text for one diagnostic pass. That lets you inspect the HTTP result and the raw body together. A response can have a valid network connection while still carrying an HTML error page, a plain-text message, or no content.

const response = await fetch(url);
const raw = await response.text();

console.log({
  status: response.status,
  contentType: response.headers.get("content-type"),
  preview: raw.slice(0, 120),
});

if (!response.ok) {
  throw new Error(`HTTP ${response.status}: ${raw.slice(0, 120)}`);
}

if (!raw.trim()) {
  return null; // Decide explicitly how your app handles an empty body.
}

const data = JSON.parse(raw);

1. Check the status. A 401, 403, 404, 429, or 500 response often has a non-JSON body even when the successful response is documented as JSON.
2. Check Content-Type. For a JSON API, expect a media type such as application/json. A header is a useful signal, but the body must still contain valid JSON.
3. Print a short escaped preview. UsingJSON.stringify(raw.slice(0, 120)) makes newlines, tabs, and some hidden characters visible.
4. Validate the captured body. If it really is JSON, a validator can identify the structural error without changing the data.
5. Fix the producer. Correct the API, template, serializer, or stored value that generated the invalid response.

RFC 8259 defines JSON as a serialized value. Objects contain double-quoted string names, a colon between each name and value, and a comma only between members. Arrays likewise use commas only between values. JavaScript object-literal conveniences do not automatically belong to JSON.

Values such as NaN, Infinity, functions, comments, and undefined are not part of JSON grammar. A top-level string, number, boolean, or null is valid under RFC 8259, although some older systems accept only an object or array.

The parser message describes the text, not where that text came from. Locating the boundary that introduced it is often more useful than staring at the final JSON.parse() call.

Position 0 is the beginning of the string supplied to the parser. Higher position numbers point near the character where the parser could no longer continue, not necessarily where the original mistake began. A missing quote or bracket earlier in the text can make a later character look unexpected.

Error formats are engine-specific. One browser may report a zero-based position while another reports a line and column. Use the number to create a small context window, then inspect the structure before and after it.

function parseJsonWithContext(raw) {
  try {
    return { ok: true, value: JSON.parse(raw) };
  } catch (error) {
    return {
      ok: false,
      error: error instanceof Error ? error.message : String(error),
      preview: JSON.stringify(raw.slice(0, 120)),
    };
  }
}

For long payloads, calculate the line and column from the characters before the reported position or paste the captured text into the ONLINTools JSON Formatter. Formatting valid sections makes mismatched brackets and missing separators easier to see.

• Serialize with a JSON library. Generate payloads withJSON.stringify() or the equivalent serializer in your language instead of concatenating strings by hand.
• Return consistent error envelopes. If an API promises JSON, its error responses should also use JSON and the appropriate HTTP status.
• Test non-success paths. Authentication expiry, rate limits, reverse-proxy failures, and missing routes are frequent sources of HTML bodies in JSON clients.
• Validate at system boundaries. Check untrusted API, file, queue, and local-storage data before the rest of the application depends on its shape.
• Log safely. A short preview helps debugging, but redact access tokens, personal data, and secrets before storing request or response bodies.