Zod vs Yup vs Joi: The Definitive Validation Library Comparison (2026)

Runtime validation is one of those problems that seems trivial until it isn’t. You have TypeScript types at compile time — but types disappear at runtime. A user submits a form, an external API returns unexpected data, or a database record has drifted from your schema. Without runtime validation, these become silent bugs or unhandled exceptions in production.

Three libraries dominate the JavaScript/TypeScript validation landscape: Zod, Yup, and Joi. Each has a different philosophy, strengths, and sweet spots. This guide gives you an honest, detailed comparison so you can make the right choice for your project in 2026.

Why Runtime Validation Matters in TypeScript Projects

TypeScript’s type system is structural and erased — your types exist only in the editor and compiler. At runtime, you’re back in JavaScript. This matters most at trust boundaries:

HTTP request bodies (user input, form submissions)
API responses from external services
Environment variable parsing at startup
Database records read from legacy tables
File uploads and user-generated content

Without validation, you’re implicitly trusting that the data matches your types. That trust gets violated constantly in production. A proper validation library gives you type safety at the boundary — and generates TypeScript types from the schema so you don’t define types twice.

Zod: TypeScript-First and Beloved

Zod is the newest of the three (2020) and has become the default choice for TypeScript projects. Its core insight: define your schema once, and let Zod infer the TypeScript type from it.

import { z } from 'zod';

const UserSchema = z.object({
  id: z.string().uuid(),
  email: z.string().email(),
  age: z.number().int().min(18).max(120),
  role: z.enum(['admin', 'user', 'viewer']),
  createdAt: z.coerce.date(),
});

// Inferred TypeScript type — no duplicate definition
type User = z.infer<typeof UserSchema>;

parse vs safeParse

Zod gives you two parsing modes:

// parse: throws ZodError on failure
const user = UserSchema.parse(rawData); // throws if invalid

// safeParse: returns { success, data } or { success, error }
const result = UserSchema.safeParse(rawData);
if (result.success) {
  console.log(result.data.email); // fully typed
} else {
  console.log(result.error.issues); // detailed error array
}

safeParse is the idiomatic choice for server-side validation — never throw on untrusted input.

Zod Strengths

TypeScript inference: Best-in-class. The inferred types are precise and ergonomic.
Composability: Transform, refine, brand, and pipe schemas with a clean API.
tRPC native: tRPC is built on Zod — input/output validation is automatic.
Bundle size: ~3 KB gzipped (core). Tree-shakeable.
Active development: 34K+ GitHub stars, frequent releases, vibrant ecosystem.
Error formatting: z.ZodError.format() returns a nested object that maps directly to form fields.

Zod Weaknesses

Async validation: Possible with .refine(async fn), but requires parseAsync — easy to forget.
Complex cross-field validation: Requires .superRefine() which can be verbose.
Strict by default: Objects are stripped by default, not passthrough — sometimes surprising.

Yup: Mature, Flexible, and React-Friendly

Yup (2016) was the go-to validation library in the React ecosystem for years, popularized by Formik. It’s a declarative schema builder with strong async support and a familiar, fluent API.

import * as yup from 'yup';

const userSchema = yup.object({
  id: yup.string().uuid().required(),
  email: yup.string().email().required(),
  age: yup.number().integer().min(18).max(120).required(),
  role: yup.string().oneOf(['admin', 'user', 'viewer']).required(),
});

// TypeScript inference — less precise than Zod
type User = yup.InferType<typeof userSchema>;

Async Validation

Yup shines with async validation, which is baked into the design:

const schema = yup.object({
  username: yup
    .string()
    .required()
    .test('unique', 'Username already taken', async (value) => {
      const exists = await checkUsernameExists(value);
      return !exists;
    }),
});

// Always returns Promise
const validated = await schema.validate(data, { abortEarly: false });

Yup Strengths

Async-first: Every validation returns a Promise — no special handling needed.
React Hook Form: First-class resolver support via @hookform/resolvers/yup.
Formik compatibility: Deep historical integration.
Transform/cast: Strong coercion behavior with schema.cast().
Cross-field validation: .when() for conditional rules is intuitive.

Yup Weaknesses

TypeScript inference: Weaker than Zod. Required/optional handling generates wider types.
Bundle size: ~17 KB gzipped — larger than Zod and Joi.
Performance: Async-by-default adds overhead even for sync validations.
API verbosity: .required() everywhere; defaults to optional in a non-obvious way.

Joi: Battle-Tested with a JavaScript Heritage

Joi (2012) is the elder statesman — originally from the hapi.js framework. It’s deeply battle-tested, has an enormous ecosystem, and is the go-to for Node.js backend validation.

const Joi = require('joi');

const userSchema = Joi.object({
  id: Joi.string().uuid().required(),
  email: Joi.string().email().required(),
  age: Joi.number().integer().min(18).max(120).required(),
  role: Joi.string().valid('admin', 'user', 'viewer').required(),
});

const { error, value } = userSchema.validate(data, { abortEarly: false });
if (error) {
  console.log(error.details); // array of validation errors
}

Joi Strengths

Maturity: 12+ years in production. Every edge case is handled.
Ecosystem: Deep integration with Fastify, hapi, Express middleware.
Customization: Extensive extension API for custom types and rules.
Documentation: Comprehensive, well-tested documentation.
Validation options: allowUnknown, stripUnknown, presence give fine-grained control.

Joi Weaknesses

TypeScript support: Added later — not native. Types via @hapi/joi are functional but not elegant.
Bundle size: ~25 KB gzipped — the largest of the three.
API verbosity: Chains can get long and repetitive.
No type inference: You write the TypeScript type separately from the Joi schema.

Performance Benchmarks

In typical usage, all three are fast enough that they won’t be your bottleneck. That said, for high-throughput APIs, differences matter:

Library	Simple object validation	Array of 1000 items
Zod	~0.15ms	~8ms
Yup	~0.80ms	~45ms
Joi	~0.20ms	~12ms

Benchmarks are approximate; results vary by schema complexity and runtime.

Zod is the fastest at runtime. Yup’s async-by-default architecture adds overhead. Joi is competitive for simple schemas but scales less well with large datasets.

Integration Comparison

React Hook Form

All three work with React Hook Form via @hookform/resolvers:

// Zod
import { zodResolver } from '@hookform/resolvers/zod';
const form = useForm({ resolver: zodResolver(UserSchema) });

// Yup
import { yupResolver } from '@hookform/resolvers/yup';
const form = useForm({ resolver: yupResolver(userSchema) });

// Joi
import { joiResolver } from '@hookform/resolvers/joi';
const form = useForm({ resolver: joiResolver(userSchema) });

Zod gives the best TypeScript DX here — the resolver infers the form types automatically with no extra annotations.

tRPC

tRPC is built on Zod. Using Yup or Joi requires a compatibility adapter and loses some of the elegance:

// Zod — native, zero config
export const appRouter = router({
  createUser: procedure
    .input(UserSchema)
    .mutation(({ input }) => createUser(input)), // input fully typed
});

Use Zod with tRPC — there’s no good reason not to.

Fastify

Fastify has built-in JSON Schema validation, but fastify-zod and Joi plugins are mature:

// Fastify + Zod (via @fastify/type-provider-zod)
fastify.post('/users', {
  schema: { body: UserSchema },
}, async (req) => {
  const user = req.body; // typed as User
});

// Fastify + Joi (native plugin support)
fastify.post('/users', {
  preHandler: validate(Joi.object({ ... })),
}, handler);

Joi has deeper historical Fastify integration. Zod is catching up quickly.

Migration Paths

Joi → Zod

Map one-to-one: Joi.string() → z.string(), Joi.object() → z.object(), Joi.array() → z.array(). The main difference: Zod infers types, so delete your separate TypeScript interfaces after migration.

Yup → Zod

Nearly identical API surface. Key differences: Zod uses z.infer<typeof schema> instead of yup.InferType. Replace .required() chains with Zod’s non-optional defaults.

Recommendation by Use Case

Use Case	Recommendation	Reason
TypeScript-first greenfield	Zod	Best type inference, smallest bundle, tRPC native
React + Formik legacy app	Yup	Already integrated; migration cost outweighs benefits
Node.js backend (Express/Fastify)	Zod or Joi	Zod for TypeScript; Joi if JS or existing ecosystem
tRPC project	Zod	Built-in, zero friction
Async validation heavy (DB checks)	Yup or Zod	Yup async-first; Zod parseAsync works well too
Enterprise / large team	Zod	Best docs, active maintenance, community

Final Verdict

Zod is the right default in 2026 for most new TypeScript projects. Its type inference is unmatched, its bundle is lean, and its ecosystem has exploded. If you’re starting from scratch or migrating a TypeScript project, Zod is the answer.

Yup remains the best choice if you’re deep in Formik or have heavy async validation needs with an existing Yup setup — migration cost can be high with no clear technical gain.

Joi is still excellent for pure JavaScript Node.js backends, particularly if you’re in a hapi/Fastify ecosystem or maintaining a large existing codebase.

All three are production-ready. The differences are in ergonomics and TypeScript DX, not correctness. Pick based on your stack and team constraints — but if you’re greenfield in 2026, use Zod.

Need to validate your API schemas live? Try our free JSON Schema Validator and API Request Builder to test validations in the browser.