JSON vs YAML vs XML: Which Configuration Format Wins?

The Same Config in All Three Formats

Here is a database configuration expressed in JSON, YAML, and TOML. Read all three and notice what your brain finds easiest — that instinct usually points to the right answer for your use case.

// JSON — no comments allowed, verbose punctuation
{
  "database": {
    "host": "localhost",
    "port": 5432,
    "name": "production_db",
    "ssl": true,
    "pool": {
      "min": 2,
      "max": 10,
      "timeout": 30000
    }
  }
}

# YAML — comments work, but whitespace is significant
# This is the production database config
database:
  host: localhost
  port: 5432           # PostgreSQL default
  name: production_db
  ssl: true
  pool:
    min: 2
    max: 10
    timeout: 30000     # 30 seconds in ms

# TOML — explicit types, comments, no significant whitespace
# Production database configuration

[database]
host = "localhost"
port = 5432           # PostgreSQL default
name = "production_db"
ssl = true

[database.pool]
min = 2
max = 10
timeout = 30_000      # Underscores allowed in numbers for readability

JSON: Fast, Strict, Commentless

JSON is defined byIETF RFC 8259. Its rules are intentionally minimal: six data types (string, number, boolean, null, array, object), no comments, strict quoting requirements.

The no-comments restriction is a deliberate design choice. Douglas Crockford, who formalised JSON, removed comment support because comments were being used to embed parser directives — turning a data format into a config language. For data interchange (API responses, serialised state), this strictness is a feature. For configuration files, it is a constant frustration.

Where JSON excels: speed. JSON.parse() is a native browser function compiled directly into the JavaScript engine. It is 10–15× faster than js-yaml and comparable to the fastest compiled-language YAML parsers.

YAML: Readable but Treacherous

YAML's design goal was human readability above all else. It achieves this — a YAML config file is often easier to read than its JSON equivalent, especially for nested structures and multi-line strings.

But YAML hides serious parsing traps.

The Norway Problem — YAML's Famous Boolean Trap

In YAML 1.1, the following strings are all parsed as boolean values without quotes:

# YAML 1.1 boolean traps (22 values total)
true:  true, True, TRUE, yes, Yes, YES, on, On, ON
false: false, False, FALSE, no, No, NO, off, Off, OFF

# Real-world consequence: country codes in a config
country_code: NO   # → parsed as false (Norway's ISO code!)
feature_flag: yes  # → parsed as true (you wanted the string "yes")

# Fix: always quote strings that might match boolean patterns
country_code: "NO"
feature_flag: "yes"

YAML 1.2 fixed this — only true and falseare boolean. But most parsers (including js-yaml below version 4.0, PyYAML, and Go's gopkg.in/yaml.v2) still implement YAML 1.1. Check your parser version before trusting unquoted strings.

Tabs Are Illegal in YAML

YAML prohibits tab characters for indentation. Only spaces are valid. Many code editors default to tabs for some file types — this causes silent parse failures in YAML files opened and edited by tab-defaulting editors.

# WRONG — tab character for indentation causes a parse error
database:
	host: localhost   # ← tab here — INVALID YAML

# Correct — spaces only
database:
  host: localhost   # ← two spaces — valid

Implicit Type Coercion Surprises

YAML infers types from unquoted values. This causes data corruption in unexpected places:

# Type coercion surprises in YAML
version: 1.0       # → float 1.0 (not string "1.0")
phone: 07911123456 # → int 7911123456 (leading zero stripped!)
hex_color: 0xFF    # → int 255 (hex parsed!)
date: 2026-07-02   # → datetime object (not string!)
null_val:          # → null (empty value is null)

# These all need quoting to remain strings:
version: "1.0"
phone: "07911123456"
hex_color: "0xFF"
date: "2026-07-02"

TOML: The Underrated Alternative

TOML (Tom's Obvious Minimal Language) was created by Tom Preston-Werner (GitHub co-founder) specifically to be a configuration format without YAML's ambiguity problems.

TOML's type system is explicit: strings require quotes, integers and floats are distinguished, dates are a native type, and there is no implicit coercion. A TOML file never silently converts NO to false.

It is now the default configuration format for several major ecosystems:

• Rust: Cargo.toml (every Rust project)
• Python: pyproject.toml (PEP 517/518 packaging standard)
• Hugo: config.toml (static site generator)
• Zola, Nix, uv, Rye: all default to TOML

Full Format Comparison

Edge Cases That Break Each Format

YAML Anchors — Powerful but Confusing

YAML supports anchors and aliases for reusing values across a file. This is useful for large configs but a debugging nightmare when overused:

# YAML anchor — define once
defaults: &defaults
  retries: 3
  timeout: 5000

# YAML alias — reuse the anchor (merges the values)
production:
  <<: *defaults    # Inherits retries: 3 and timeout: 5000
  host: prod.example.com

staging:
  <<: *defaults
  host: staging.example.com
  timeout: 10000   # Override just this value

Anchors work well when used sparingly. Files with anchors of anchors of anchors become very hard to debug. No equivalent exists in JSON or TOML.

JSON Trailing Commas — Still Broken in 2026

Standard JSON does not allow trailing commas. This is an endless source of parse errors:

// INVALID JSON — trailing comma after last element
{
  "name": "FileMint",
  "version": "2.0",   // ← trailing comma — JSON.parse() throws
}

// VALID JSON — no trailing comma
{
  "name": "FileMint",
  "version": "2.0"
}

// Note: JSONC (JSON with Comments) and JSON5 allow trailing commas
// Use these for config files read by tools that support them (VS Code, ESLint)

YAML Multi-line String Modes

YAML has two multi-line string operators with different newline handling:| (literal, preserves newlines) and> (folded, collapses newlines to spaces). Using the wrong one produces unexpected whitespace in parsed strings:

# Literal block (|) — preserves every newline
message: |
  Line one
  Line two
# → "Line one
Line two
"

# Folded block (>) — newlines become spaces (except blank lines)
message: >
  Line one
  Line two
# → "Line one Line two
"

# Folded is for prose. Literal is for code, SQL, or anything line-sensitive.

My Recommendation by Use Case

When you must use YAML: always quote strings that could match boolean patterns. Set your editor to show whitespace characters. Use a YAML linter (yamllint) in your CI pipeline. These three habits eliminate the class of bugs that cost me 40 minutes in production.

For API-level format decisions (not configuration files), our XML vs JSON comparison covers the performance and schema validation tradeoffs that apply when the format is used in network communication rather than local config files. If you need to convert between formats, our YAML to JSON converter runs entirely in your browser.