String Type Validation with JSON Schema

Validating Strings in JSON Schema

The string type is the most frequently used type in JSON Schema. It validates that a value is a sequence of characters and supports several built-in constraints for controlling length and format.

Core String Keywords

{
  "type": "string",
  "minLength": 3,
  "maxLength": 30
}

• minLength — the minimum number of Unicode characters. A value of 0 allows empty strings, while 1 requires at least one character.
• maxLength — the maximum number of Unicode characters. Use this to prevent excessively long inputs that could cause storage or display issues.
• pattern — a regular expression the string must match. The regex dialect is ECMA-262, the same one used in JavaScript.

How the Example Schema Works

The schema above defines an object with two string properties. The username field is required and must be between 3 and 30 characters long. The bio field is optional but, when present, must not exceed 500 characters.

When a validator receives the test data, it checks each property against its constraints:

1. "dev_user42" has 10 characters, which satisfies minLength: 3 and maxLength: 30 — valid.
2. "Full-stack developer who loves open-source tools." is well under 500 characters — valid.
3. username is present, satisfying the required constraint.

Common String Validation Patterns

You can combine pattern with length constraints for tighter validation:

{
  "type": "string",
  "minLength": 3,
  "maxLength": 30,
  "pattern": "^[a-zA-Z0-9_]+$"
}

This restricts the value to alphanumeric characters and underscores only — perfect for usernames, slugs, or identifiers.

Pitfalls to Avoid

• Unicode length: minLength and maxLength count Unicode code points, not bytes. An emoji like 😀 counts as one character in most implementations, but some older validators differ.
• Empty strings vs. missing: A property set to "" is still a string. If you require a non-empty value, set minLength: 1 rather than relying on required alone.
• Pattern anchoring: JSON Schema does not implicitly anchor regex patterns. Use ^ and $ explicitly when you want the entire string to match.