ujson

UltraJSON (ujson) is a JSON encoder and decoder for Python implemented in pure C, designed as a drop-in replacement for Python’s built-in json module with significantly faster encode/decode performance. It has no global interpreter-lock-dependent state, so calling ujson from multiple threads is organically thread-safe.

The project has shipped for over a decade and remains widely used across the Python ecosystem, though the maintainers now flag it as maintenance-only: architectural constraints make further feature changes risky from a security standpoint, so only new Python version support and critical bug/security fixes are accepted, with users pointed toward orjson for new projects wanting both speed and active feature development.

What You Get

• Drop-in ujson.dumps() / ujson.loads() matching the stdlib json API surface
• A C-implemented encoder and decoder for substantially faster throughput than pure-Python json
• Encoder options: encode_html_chars, ensure_ascii, escape_forward_slashes, indent
• Thread-safe operation with no global interpreter state shared across calls
• Prebuilt wheels for major platforms plus configurable build options (e.g. linking an external double-conversion library) for packagers

Common Use Cases

• Speeding up JSON encode/decode in performance-sensitive web services and APIs as a stdlib json swap-in
• Serializing large arrays of numbers or strings where ujson’s C implementation beats pure-Python parsing
• Legacy codebases already depending on ujson’s specific encoder option semantics (e.g. escape_forward_slashes)
• Multi-threaded applications that need a JSON codec without shared mutable global state

Under The Hood

Architecture — ujson splits cleanly into a portable C JSON engine (src/ujson/lib/ultrajsonenc.c, ultrajsondec.c, ultrajson.h) and a Python C-API binding layer (src/ujson/python/ujson.c, objToJSON.c, JSONtoObj.c) that converts between the C encoder/decoder’s representation and native Python objects (dict, list, str, int, float). Numeric formatting is delegated to a bundled copy of Google’s double-conversion library (src/ujson/deps/double-conversion/, wrapped via dconv_wrapper.cc) for accurate, fast float-to-string conversion, with an environment-variable-driven option to link an external system copy instead.

Tech Stack — Primarily C/C++ (99% of the codebase by bytes) exposed through Python’s C extension API via setup.py/pyproject.toml; packaged with prebuilt wheels via cibuildwheel-style CI, tested across CPython versions with tox, linted with flake8 and pre-commit, and dependency-updated via Renovate.

Code Quality — tests/test_ujson.py is a ~2,000-line suite covering encode/decode round-trips, edge cases (NaN/Infinity, surrogate pairs, deeply nested structures), and encoder-option behavior; a tests/fuzz.py harness and 334-reproducer.json fixture indicate the project has responded to fuzzing-discovered issues in the past — consistent with the maintainers’ own README warning that the C parsing surface has previously introduced security-sensitive bugs, which is why the project is now maintenance-only.

API Design — The public API deliberately mirrors the stdlib json module (dumps/loads) so migration requires little more than an import swap, with a small set of additive keyword options (indent, ensure_ascii, encode_html_chars, escape_forward_slashes) layered on top rather than a divergent object model — low boilerplate, but the project’s own docs now steer new adopters toward orjson for actively developed alternatives.