One header buys a familiar C++ interface, with speed left to specialists
nlohmann/json models a JSON document as a C++ value with object, array, string, numeric, Boolean, and null forms. The syntax resembles std::map and std::vector: use operator[], at(), iterators, find(), or contains(), then call dump() to serialize. Its README also covers JSON Pointer, JSON Patch, Merge Patch, and five binary formats. That range makes it a sensible default for configuration files, HTTP payloads, and application data that developers need to inspect and change.
Convenience is the product decision. The project says speed and memory efficiency were secondary goals, and a default object uses std::map while arrays use std::vector. Our 16.7 MB checkout held 1,235 files and about 157,979 lines of source, even though consumers can take only json.hpp. Pick it because the calling code is easy to read. If parsing is a measured bottleneck, compare it against simdjson or RapidJSON with your own documents.
C++11 and CMake cover old and current projects
The integration path is unusually flexible for a C++ dependency. A project can copy the single header, install a distribution package, or link the nlohmann_json::nlohmann_json CMake interface target. The README lists working GCC, Clang, Apple Clang, CUDA, Intel, and Visual C++ versions, with C++11 as the baseline. Release v3.12.0 also added CMake 4.0 support and std::optional conversions for C++17 builds. No credentials or background service are involved.
That easy consumer story differs from contributor setup. The repository has 14 CI workflow files and a tests directory, while our harness followed the Python metadata under tools/astyle. The documented C++ test route uses CMake, enables JSON_BuildTests, and runs ctest. It also downloads JSON test data from another repository unless JSON_TestDataDirectory points to a prepared local copy. Locked-down build networks need to stage that input before testing.
What happened when we ran it
Our sandbox installed the selected tools/astyle Python environment in 20 seconds. It added 36 packages and occupied 38 MB, then its build completed in 5 seconds. Those are clean results for that maintenance tool, and pip-audit reported 0 known vulnerabilities. They are not measurements of adding the single C++ header to an application, so we would not use them to claim a 20-second nlohmann/json install.
The test command failed with exit code 5 after 6 seconds. Pytest printed no tests ran in 0.00s: 0 passed and 0 failed out of 0 collected. The log does not identify a missing system package or a broken test. It shows that the detected Python project supplied no pytest cases to that command. A C++ adopter should run the documented CMake and ctest path on the compiler flags used in production.
UTF-8, unchecked access, and exceptions set firm boundaries
Strings inside the default type are UTF-8. The README says Latin-1 and ISO-8859-1 input can produce parse or serialization errors, while wide strings need conversion first. It also notes that std::string::size() counts bytes rather than user-visible characters. Those rules are reasonable for JSON, yet applications crossing Windows APIs or older data feeds need an explicit encoding boundary instead of passing native strings straight through.
Failure behavior deserves the same attention. On const objects, unchecked operator[] with a missing key has undefined behavior; at() is the documented checked choice. Disabling C++ exceptions does not turn errors into return values. Unless custom throw macros are supplied, errors call abort(). None of our 36 installed Python packages tested these paths, so production wrappers should cover malformed input, missing members, nesting, and oversized data in the actual C++ build.
Active development continues beyond the v3.12.0 release
GitHub showed 50,583 stars, 118 open issues and pull requests, and a last push on September 11, 2026. The latest tagged release was v3.12.0, published April 11, 2025. The older tag does not imply inactivity because commits and issue work continued in September 2026. The release brought diagnostic byte positions, std::optional conversion, CMake changes, and fixes while keeping its changes backward compatible.
Current issue work also shows where defensive limits belong. Issue 5320 reports corrupt MessagePack output or an out-of-bounds read above the format's documented 32-bit size limit, with a proposed fix still open. A separate deep-nesting report was closed amid active fixes in September. These cases are far outside most config files, but servers parsing hostile JSON should set input limits before handing data to any general-purpose DOM library.
The best fit is readable application code outside the parsing hot path
For ordinary C++ services and desktop software, the trade is attractive: one dependency gives developers a clear value type plus text and binary codecs. The 5-second tooling build and 0-test pytest result neither prove nor disprove C++ correctness. Evidence for the library itself comes from its documented CMake suite, sanitizer use, continuous fuzzing, release history, and the tests you run with your compiler.
Choose nlohmann/json when maintainers will benefit from obvious code more than users will benefit from the fastest possible parser. Use checked access on untrusted structures, keep strings at a UTF-8 boundary, and enforce request limits before parsing. If profiles show JSON dominating CPU time or allocations, the README already gives the honest answer: this library did not put those goals first.