Skip to main content

JSON Merge — Deep-Merge Two or More Objects

Deep-merge two or more JSON objects in the browser, with array strategy and prototype-pollution guard

  • Runs locally
  • Category Developer & DevOps
  • Best for Formatting, validating, shrinking, or inspecting code-adjacent text.
Deep-merge two or more JSON objects. Shared nested objects are merged key-by-key; on a scalar conflict the later object wins (B over A, C over B). Pick how arrays combine: replace, concat, merge-by-index, or dedupe. __proto__ is dropped to block prototype pollution. Runs entirely in your browser.
Array strategy
JSON A (base)
JSON B (overrides A)
Merged output
{
  "a": {
    "x": 1,
    "y": 2
  },
  "tags": [
    "y"
  ],
  "keep": true
}

What this tool does

Free online JSON merge tool that deep-merges two or more JSON objects in your browser. A deep merge walks both trees and combines nested objects key by key, so {"a":{"x":1}} merged with {"a":{"y":2}} gives {"a":{"x":1,"y":2}} instead of the second object replacing the first the way a shallow Object.assign or spread would. When the same key holds a scalar on both sides the later object wins, so B overrides A and C overrides B. Arrays have no single correct merge, so you choose: replace (later array wins), concat (append), merge by index (element by element), or dedupe (concat then drop duplicates). Paste a base object and one or two more to fold on top, switch the array strategy, and copy the indented result with one click. The merge skips __proto__, constructor, and prototype keys so a hostile payload cannot pollute the prototype chain. Everything runs client-side with friendly parse errors and a shareable link. 100% in-browser, nothing uploaded.

Tool details

Input
Files + Text + Numbers
The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output
Live result + Copy
The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy
Browser-side processing
The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share
Shareable URL state
Key settings are encoded in the URL so another person can reopen the same setup.
Performance budget
Initial JS <= 9 KB
No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit
Developer & DevOps · Developer
Category and role tags drive related tools, internal links, and quick fit checks.

How to use

  1. 1. Input

    Paste or drop your content into the tool panel.

  2. 2. Process

    Click the button. All processing is local in your browser.

  3. 3. Copy / Download

    Copy the result or download to disk in one click.

How JSON Merge fits into your work

Use it in the small gaps between coding, reviewing, debugging, and shipping.

Developer jobs

  • Formatting, validating, shrinking, or inspecting code-adjacent text.
  • Preparing snippets for documentation, tickets, commits, or handoff.
  • Checking a small payload quickly without switching tools.

Developer checks

  • Run irreversible transforms like minify or obfuscate on a copy.
  • Keep secrets out of pasted snippets unless the tool explicitly stays local.
  • Use your normal tests or linter before shipping transformed code.

Good next steps

These links move the current task into a more complete workflow.

  1. 1 JSON to YAML Converter Convert JSON to clean YAML — block scalars for multiline strings, optional key sorting, 2/4-space indent, line-numbered errors — browser-only Open
  2. 2 JSON Diff Structural JSON compare — added / removed / changed keys by path, three-colour tree, browser-only Open
  3. 3 JSON Formatter & Validator Format, validate, and minify JSON instantly — right in your browser. Open

Real-world use cases

  • Layer environment config over a base file

    You keep a base config.json with sane defaults and a small production.json that only lists the values that change in prod, such as the database host and the log level. Paste the base into A, the prod overrides into B, and deep merge gives you the effective config your service actually runs with. Nested blocks like logging or cache keep the keys you did not override, instead of the prod file silently wiping a whole section the way a shallow merge would.

  • Combine partial API responses or patch payloads

    A PATCH request returns only the fields it touched, and you want to see the resource as it will look after the patch lands. Paste the current resource into A and the patch body into B. The merged output is the post-patch state, with the array strategy letting you decide whether a returned list replaces or appends to the one you had.

  • Merge feature flags from multiple sources

    Flags arrive from a global default set, a team override, and a per-user override. Add all three as A, B, and C, set the array strategy to dedupe for any allow-lists, and the fold gives you the resolved flags with the per-user value winning on every conflict. Share the link so a colleague reproduces the exact resolution.

  • Stitch together translation or locale dictionaries

    You have a base en.json of UI strings and a partial override that fixes a handful of phrases without re-listing every key. Deep merge keeps the full dictionary while applying only the corrections, so you do not have to maintain two complete copies and risk them drifting. The result is a single clean dictionary ready to ship.

Common pitfalls

  • Expecting a shallow merge. Object.assign and spread replace a whole nested object; this tool deep-merges instead. If you actually wanted the later object to wipe a nested block, deep merge will surprise you by keeping the old keys. Know which one your situation needs before trusting the output.

  • Leaving the array strategy on replace when you meant to combine lists. With replace, the later array discards the earlier one entirely, so a tags or roles list quietly loses its old entries. Switch to concat or dedupe when both lists should contribute.

  • Pasting JSON5, comments, or trailing commas. The parser is strict JSON, so a // comment or a trailing comma makes that side invalid and it drops out of the merge. Run the input through the JSON Formatter first to get clean, strict JSON.

Privacy

Parsing and the deep merge are plain JavaScript that runs in your browser tab, so neither input is uploaded, logged, or analysed. The one caveat is URL state: both inputs and the array strategy sync to the query string so you can share an exact merge, which means a share link carries your data into the recipient browser history and any server access log along the way. For API keys, tokens, or unreleased payloads, copy the output text instead of sharing the URL.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Made by Toolora · 100% client-side · Updated 2026-05-29