Unexpected Token JSON Errors: 2026 Local Fix Lesson

Why does my JSON.parse throw "Unexpected token" when the API response looks perfectly valid in the browser?

Last Tuesday, at 11:47 PM, I was staring at a broken dashboard. The React app I'd been building for a logistics client pulls live shipment data from three third-party APIs, formats it, and renders it on a map. Two of the three endpoints were working fine. The third — a regional carrier's tracking feed — kept throwing Unexpected token < in JSON at position 0 in the console, even though the response body looked like perfectly valid JSON when I clicked through Chrome's Network tab.

I spent the next 22 minutes doing what most frontend developers do: eyeballing the payload, pasting it into a random online formatter, refreshing, repeating. Nothing. The formatter said the JSON was fine. The browser said it wasn't. Somewhere between the server and my JSON.parse call, something was corrupting the payload.

That night is what eventually led me to build a workflow around JSON Pulse's client-side error checker. This article walks through what I learned — specifically, how to identify and fix unexpected token JSON syntax errors locally, without round-tripping your data through a server or a black-box validator.

What is an "Unexpected token" error in JSON?

An "Unexpected token" error is JavaScript's way of telling you that the string you passed to JSON.parse contains a character — or sequence of characters — that doesn't conform to the JSON grammar at that specific position.

The keyword there is position. The error message almost always includes a position number, like Unexpected token , in JSON at position 47. That number is your single most valuable clue. It tells you exactly where the parser gave up.

In my case, the message was Unexpected token < in JSON at position 0. Position 0. The very first character. Which meant the string didn't start with { or [ — it started with <. That's the classic signature of an HTML error page being returned instead of JSON, usually because the API server threw a 500 and returned its default error template.

But here's the thing: Chrome's Network panel was showing me the parsed preview, not the raw response body. The raw body started with <!DOCTYPE html>. The preview tab had helpfully rendered it as a DOM. I was debugging against a lie.

How do I find the exact character causing the JSON syntax error?

This is where most developers waste time. The standard advice — "just look at the position number" — falls apart when you're dealing with a minified 14,000-character response from a production API. Position 8,432 means nothing to a human eye.

JSON Pulse's client-side error checker solves this by taking the raw string and the reported position, then surfacing three things at once:

The offending character, highlighted in context

Instead of jumping to position 8,432 in a wall of text, the checker shows you a window — usually 80 characters before and after the token — with the problem character highlighted. You see the surrounding structure immediately.

The character's Unicode code point

This matters more than people realize. A common cause of unexpected token errors is an invisible character: a zero-width space (U+200B), a non-breaking space (U+00A0), a byte order mark (U+FEFF), or a smart quote (U+201C) that snuck in from a copy-paste operation. The checker displays the code point, so you instantly know whether you're dealing with a structural problem (a missing comma, a trailing comma) or a character-encoding problem.

A plain-language explanation

"Unexpected token" is parser jargon. The checker translates it: "You have a trailing comma after the last property in an object," or "You used single quotes instead of double quotes around a string value." That translation is the difference between a 30-second fix and a 30-minute guessing game.

Can I validate JSON locally without sending data to a server?

Yes, and for most working developers, this is the only option that's both fast and safe.

The logistics dashboard I was building handles shipment data — addresses, tracking numbers, customer references. Pasting that into a random online JSON validator was a non-starter. Even aside from the privacy concern, round-tripping a 14KB payload through a third-party server adds latency and introduces its own failure modes. What if the validator's server is down? What if it mangles the response?

JSON Pulse's checker runs entirely in the browser. The JSON string you paste never leaves your machine. The parsing, the position analysis, the character lookup — all of it happens client-side in JavaScript. For my use case, that meant I could paste a real production response, including customer data, and debug it without thinking twice.

The performance difference is real, too. On the 8,432-character regional carrier response, the checker returned its full analysis in under 40 milliseconds. The online validator I'd been using earlier took 3.4 seconds to round-trip and came back with only "Invalid JSON" — no position, no character, no explanation.

What causes "Unexpected token < in JSON"?

What causes "Unexpected token in JSON"?

This specific error variant almost always traces back to one of six root causes. Once you know the pattern, diagnosis gets fast — but only if you're looking at the raw string, not a prettified preview.

1. HTML or plaintext returned instead of JSON

This is the position-0 case I hit last Tuesday. The server threw an error, returned a 500 status page, and your fetch call blindly passed the body into JSON.parse. The first character is <, not {, and the parser dies immediately. The fix is to check response.ok and the Content-Type header before parsing — and to log the raw body when the status code isn't 200.

2. A BOM or invisible leading character

Some APIs prepend a UTF-8 byte order mark (U+FEFF) to the response. It's invisible in most editors and in Chrome's preview tab, but JSON.parse sees it as a character and throws "Unexpected token in JSON at position 0." The fix is to strip leading BOM characters before parsing: a simple regex like str.replace(/^\uFEFF/, '') handles it.

3. Single quotes instead of double quotes

JSON is stricter than JavaScript object literals. {'key': 'value'} is valid JS but invalid JSON. This shows up most often when developers hand-write mock data or copy a JavaScript object literal into a .json file. The error message typically points at the opening single quote.

4. Trailing commas

Another JavaScript-permissive feature that JSON rejects. {"name": "Acme",} throws an unexpected token at the closing brace because the parser expects another key-value pair after the comma. This one is common in generated payloads where a templating engine loops through items and appends a comma after each one — including the last.

5. Unescaped control characters in string values

If a string field contains a literal newline, tab, or backspace character — not the escaped sequence \n but the actual raw byte — the parser will break at that position. This happens with user-generated content that wasn't properly sanitized before being serialized. The position number in the error message will point directly at where the raw character sits.

6. Smart quotes from copy-paste

Word processors and some email clients auto-convert straight quotes to curly ones (U+201C and U+201D). If someone copies a JSON snippet from a Word document or an email and pastes it into a config file, the parser will reject those characters. The Unicode code point display in JSON Pulse's checker catches this instantly — you see U+201C instead of U+0022 and know exactly what happened.

How do I build a reliable local debugging workflow?

After that Tuesday night, I stopped reaching for random validators and built a repeatable process. It takes under a minute now, and it works whether the payload is 200 characters or 200,000.

• Capture the raw response body. Not the preview. Not the parsed object. The raw text. In Chrome's Network tab, that's the "Response" sub-tab, not "Preview." In code, it's await response.text() before you attempt response.json().
• Check the HTTP status and Content-Type first. If the status isn't 2xx, or the Content-Type isn't application/json, you don't have a JSON problem — you have an API problem. Fix that first.
• Paste the raw string into the client-side checker. The checker runs locally, so there's no privacy concern with production data. It returns the position, the offending character, the Unicode code point, and a plain-language explanation in one pass.
• Fix the specific issue, then re-validate. Don't assume one fix solves everything. A minified response can have multiple syntax errors. Re-run the checker until it reports clean.
• Add a guard to your parsing code. Wrap JSON.parse in a try/catch that logs the raw body and the position on failure. Future-you will thank present-you.

The Bottom Line

"Unexpected token" is not a mysterious error. It's a precise, positional message that tells you exactly where the parser gave up and, with the right tool, exactly why. The problem most developers face isn't that the error is unclear — it's that they're debugging against a prettified lie instead of the raw string, and they're using tools that strip away the two pieces of information that matter most: the position and the character.

The shift that made the difference for me was simple: stop round-tripping payloads through remote validators and start analyzing them locally. The raw string, the position number, the Unicode code point — those three data points resolve virtually every unexpected token error in under a minute. When the logistics dashboard went live the following week, the regional carrier's API threw two more HTML error pages during the first 48 hours. Both times, the checker identified the problem in position 0 in under 40 milliseconds. Both times, the fix was a one-line guard clause. No guessing, no pasting into random websites, no 3 a.m. debugging sessions against a preview tab that was lying to me.

If you're hitting unexpected token errors regularly, the workflow is worth building. The tool is already there — the discipline of capturing raw responses and reading the position number is what makes it work.