Zod is a TypeScript-first schema declaration and validation library. You describe the shape of your data once, as a runtime schema, and Zod gives you two things for the price of one: a validator that checks unknown input at runtime, and a static TypeScript type inferred from that same schema. There is no code generation step and no separate type declaration to keep in sync.

{
  "name": "zod",
  "version": "4.4.3",
  "type": "module",
  "license": "MIT",
  "author": "Colin McDonnell <zod@colinhacks.com>",
  "description": "TypeScript-first schema declaration and validation library with static type inference"
}

The package has zero runtime dependencies — packages/zod/package.json contains no dependencies field at all — and works in Node.js, browsers, Deno (published to JSR as @zod/zod), and edge runtimes such as Cloudflare Workers.

What people use it for

• API request validation. A server receives unknown JSON. schema.safeParse(body) either returns typed data or a structured ZodError whose issues carry paths into the payload, ready to send back as a 400 response.
• Form validation. Schemas compose per-field rules (z.string().min(5), z.email()) and error messages are customizable at the check, schema, parse-call, or global level, with more than 50 bundled locales.
• Type-safe configuration and environment parsing. z.coerce.number() and friends turn process.env strings into typed, validated config objects at startup.
• Schema-first types. z.infer<typeof schema> derives the static type from the schema, and z.toJSONSchema(schema) converts it to JSON Schema for OpenAPI documents or LLM structured outputs.

The one-minute version

import { z } from "zod";

const formDate = z.iso
  .datetime({ offset: true })
  .or(z.literal(""))
  .transform((v) => (v === "" ? null : v));

console.log("empty:", formDate.safeParse(""));
console.log("valid:", formDate.safeParse("2024-01-15T10:30:00.000Z"));
console.log("invalid:", formDate.safeParse("not-a-date"));

That file sits at the repo root and is the maintainers' own scratchpad (pnpm dev:play runs it). It shows the core loop: build a schema by chaining, feed it untrusted input, get back a discriminated result.

This repository

This is a pnpm monorepo. The published library is one workspace package, packages/zod; everything else is infrastructure around it — benchmarks, the documentation site, integration and module-resolution test suites, tree-shaking fixtures, and a compiler-performance harness. The library itself ships three API surfaces from a shared core: zod (classic, method-chaining), zod/mini (tree-shakable, function-based), and zod/v4/core (the internals both are built on, also used by other libraries in the ecosystem).

Where to go next

• Using Zod in an application and want a fast, receipt-backed tour of the API: the five-minute tour.
• Contributing a fix or feature: onboarding walks through setup, the repo layout, and a first change.
• Curious what actually happens inside schema.parse(data): the parse pipeline.
• Evaluating the engineering: zero runtime dependencies documents the dev toolchain, and the public API maps every entry point.
• Solving a concrete task: validation recipes and JSON Schema and codecs.