ast.literal_eval() vs eval() for pasted data
A pasted Python representation is data, not a program. Parse only literal values when you need to inspect it.
Why eval() is risky
eval() executes a Python expression. If its input came from a log, clipboard, user, file, or network response, it can run code you did not intend to run. It is not a parser for untrusted data.
What ast.literal_eval() does instead
ast.literal_eval() accepts Python literal structures such as strings, numbers, tuples, lists, dictionaries, sets, booleans, and None. It rejects general function calls, variable names, and nonliteral expressions.
import ast
import json
python_text = "{'active': True, 'owner': None}"
value = ast.literal_eval(python_text)
json_text = json.dumps(value, indent=2)
print(json_text)
# {
# "active": true,
# "owner": null
# }A copied expression such as 1 + 2 is not a literal value:
try:
ast.literal_eval("1 + 2")
except (ValueError, SyntaxError):
print("Not a Python literal")It is still sensible to impose input-size limits and handle exceptions. A very large or deeply nested literal can exhaust memory or the parser's stack; literal_eval() should not be treated as safe for unlimited untrusted input. Set limits appropriate to your application.
Use JSON when you control the format
For data exchanged between systems, prefer JSON and parse it with json.loads(). JSON is a defined interchange format; Python literal syntax is useful when a developer has copied a representation from a REPL or debugger. For example, json.loads('{"active": true}') parses JSON directly, while the same text is not a Python dict literal because true is not Python's True.
Choose a parser from the input, not from the file extension
| Copied text | In Python | In this browser tool |
|---|---|---|
{"ok": true} | json.loads() | Read as JSON |
{'ok': True} | ast.literal_eval(), then encode | Read as a Python literal |
datetime.datetime(2026, 10, 19) | Not a literal accepted by literal_eval(); serialize the object at its source | A supported positional datetime representation |
Decimal('19.90') or a custom call | Choose a representation in the producing application | Rejected |
Open a copied datetime payload and press Convert. Acceptance here does not imply that Python's literal_eval() accepts the same input. This site has its own parser with a small, explicit set of recognized forms; it does not evaluate the text with Python.
Keep the original when the representation is ambiguous
If a paste includes a variable such as current_user, the name alone does not contain the value. Likewise, a custom object's representation may omit fields. Replacing unknown names with None or deleting an unsupported call can produce valid JSON that no longer means the same thing. Get a structured export from the original program instead.
For server-side uses of literal_eval(), consult the Python documentation's resource-exhaustion warning and enforce limits appropriate to the service. A parser that avoids arbitrary execution is still not a promise that unlimited input is harmless.