What is the difference between shallow merge and deep merge for JSON?

A shallow merge copies only top-level keys from the source into the target. If both objects contain a nested object under the same key, the source replaces the target entirely — nested values are lost. A deep merge recurses into every nested object, merging children recursively so you keep settings from both sides. Shallow is faster and the default for Object.assign / spread. Deep is what you usually want for configs, feature flags, and partial API payloads.

How do I merge two JSON objects without losing nested data?

Use a deep merge. Walk every key of the source. If the value is a plain object and the target already has an object at that key, recurse. Otherwise, overwrite. Arrays are not deep-merged by default — the source array replaces the target. Example in JS: Object.keys(src).forEach(k => target[k] = (isObject(src[k]) && isObject(target[k])) ? deepMerge(target[k], src[k]) : src[k]). Our tool does this automatically.

What is JSON Merge Patch (RFC 7396)?

RFC 7396 is a standard for applying partial updates to a JSON document. The patch is itself a JSON object: present keys replace the target value, nested objects merge recursively, and the special value null deletes the key from the target. It is simpler than JSON Patch (RFC 6902) and widely used by REST APIs like Kubernetes and GitHub for PATCH endpoints. Example: patching {"a": 1, "b": 2} with {"b": null, "c": 3} yields {"a": 1, "c": 3}.

How are arrays merged when combining two JSON objects?

There is no universal rule — arrays can be replaced, concatenated, or merged by index or by a key field. The default in Object.assign, lodash.merge, and JSON Merge Patch is REPLACE: the source array wins. If you need to append, use a concatenation strategy (target = [...target, ...src]). If you need to merge by id (common for lists of records), key both arrays by the id field, merge the resulting maps, and convert back to an array. Our tool exposes shallow, deep, and merge-patch — pick concatenate manually for append.

Can I merge more than two JSON objects at once?

Yes. The merge is associative for shallow and deep: merging A then B then C into a target gives the same result as merging them left-to-right. Later objects take precedence over earlier ones for conflicting keys. Paste all objects into the tool separated by a blank line, or chain merges in code: const result = [a, b, c].reduce((acc, obj) => deepMerge(acc, obj), {}).

Is my JSON data safe when I use this online merger?

Yes — all merging runs client-side in your browser. No data is ever sent to a server. You can paste production configs, API responses, auth payloads, or PII without them leaving your tab. Open the Network tab in DevTools to verify: zero outgoing requests during a merge.

JSON Merge Online — Shallow & Deep Merge Two JSON Objects (Free)

Combine two JSON objects — shallow merge, deep merge, or RFC 7396 Merge Patch. Everything runs in your browser.

Why Merging JSON Needs Three Strategies

Combining two JSON objects seems trivial until a config file goes stale, a feature flag overwrites itself to {}, or a PATCH request to a REST API silently drops every nested key. The reason is that merge is not one operation — it is at least three, and the right choice depends on what the two objects represent.

A shallow merge copies top-level keys from the source over the target. This is what Object.assign(target, src) and the spread operator{...target, ...src} do in JavaScript. It is fast and correct for flat objects, but if both sides contain a nested object under the same key, the source wins outright and anything the target had under that key is lost.

A deep mergewalks every nested object and merges children recursively. Nested keys from both sides are preserved. Arrays, by default, are replaced wholesale (you almost never want "merge item 0 of A with item 0 of B"). This is what you want for layered configs — a base config plus a per-environment override — and for most feature-flag systems.

JSON Merge Patch (RFC 7396) is a deep merge with one extra rule: anullvalue in the patch deletes the matching key from the target. This lets you express "remove this field" in a PATCH payload without a separate schema. Kubernetes and GitHub use merge-patch semantics for many of their REST endpoints.

Example: Shallow vs Deep

Target and source:

// target
{
  "name": "promptspace",
  "settings": { "theme": "dark", "lang": "en" },
  "tags": ["ai", "prompts"]
}

// source
{
  "settings": { "theme": "light" },
  "tags": ["new"]
}

Shallow merge (lossy — settings.lang disappears):

{
  "name": "promptspace",
  "settings": { "theme": "light" },
  "tags": ["new"]
}

Deep merge (settings merge, tags replace):

{
  "name": "promptspace",
  "settings": { "theme": "light", "lang": "en" },
  "tags": ["new"]
}

JSON Merge Patch (RFC 7396) in One Rule

Merge-patch is a deep merge with a kill-switch for individual keys. If a value in the patch is null, the key is removed from the target. Everything else behaves like deep merge. The spec is 15 pages long but boils down to:

// Target
{ "a": 1, "b": { "x": 10, "y": 20 }, "c": 3 }

// Patch
{ "b": { "x": null }, "c": null, "d": 4 }

// Result
{ "a": 1, "b": { "y": 20 }, "d": 4 }

c was deleted. b.x was deleted. b.y stayed because the patch did not mention it. d was added.

JavaScript Code Equivalents

Shallow and deep merges are a handful of lines each. The common library choice islodash.merge for deep, which handles nested objects, arrays and primitives correctly.

// Shallow — native, no library
const shallow = { ...target, ...source };
// or
const shallow2 = Object.assign({}, target, source);

// Deep — hand-rolled, 10 lines
function deepMerge(target, source) {
  const out = Array.isArray(target) ? [...target] : { ...target };
  for (const key of Object.keys(source)) {
    const sv = source[key];
    const tv = out[key];
    if (sv && typeof sv === 'object' && !Array.isArray(sv) &&
        tv && typeof tv === 'object' && !Array.isArray(tv)) {
      out[key] = deepMerge(tv, sv);
    } else {
      out[key] = sv;
    }
  }
  return out;
}

// Deep — with lodash
import merge from 'lodash.merge';
const deep = merge({}, target, source);

Python Equivalents

Python has no built-in deep merge. The one-liner {**a, **b} is shallow. For deep, hand-roll a recursive function or use deepmerge ormergedeep from PyPI.

# Shallow
shallow = {**target, **source}

# Deep — hand-rolled
def deep_merge(target, source):
    out = dict(target)
    for k, v in source.items():
        if isinstance(v, dict) and isinstance(out.get(k), dict):
            out[k] = deep_merge(out[k], v)
        else:
            out[k] = v
    return out

# Deep with mergedeep
from mergedeep import merge
result = merge({}, target, source)  # mutates first arg, returns it

Array Merge Strategies

Arrays are where every merge library disagrees. The common strategies:

Replace (default for most libs and for JSON Merge Patch) — the source array wins outright. Simple, predictable.
Concat — append source to target. Good for append-only lists. Watch for duplicates.
Merge by index — pair up items by position. Rarely what you want.
Merge by key — pair items by a shared field like id, then merge each pair as objects. The right choice for lists of records.

Our tool defaults to replace for both deep merge and merge patch to match RFC 7396. To concatenate, do it in code before pasting:target.items = [...target.items, ...source.items].

Common Pitfalls

Mutating the input. Object.assign(target, source) mutatestarget. Always start with Object.assign({}, target, source)or spread into a new object.
Mixing Dates, Maps, or class instances. Deep merge usually treats everything with typeof 'object' as mergeable, which breaks on Date, Map, Set, and custom classes. Stick to plain JSON (strings, numbers, booleans, arrays, plain objects) when merging.
Prototype pollution. Never deep-merge arbitrary user input into an object that uses prototype properties. A malicious __proto__ key can poison every object in the runtime. Lodash merge patched this in v4.17.21 — upgrade if you are on an older release.
Null in a deep merge (non-patch). Pure deep merge treatsnull as a value and overwrites. If you need delete-on-null, switch to Merge Patch mode.

When to Use Which Strategy

Flat config, env overrides, DOM props → shallow merge. Fastest, zero surprises.
Layered configs, feature flag defaults + overrides → deep merge.
REST PATCH endpoints, Kubernetes manifests, GitHub API payloads → Merge Patch (RFC 7396). Deletion-via-null is a feature here.
Partial state updates in Redux / Zustand → shallow for top-level slices, deep for nested stores. Most state libraries do shallow by design.

Related JSON Tools

JSON Formatter — the parent tool with interactive input and real-time validation.
JSON Diff Online — compare two JSON objects and see every change before merging.
JSON Schema Validator — validate the merged result against a schema.
JSON Flattener — flatten nested keys to dot-paths, which can simplify merging deeply-nested configs.