Zod

Zod lets you define data shapes once and get both runtime validation and TypeScript types from the same definition. No more writing types AND validation logic separately.

MIT license, zero dependencies. You define a schema like `z.object({ name: z.string, age: z.number })` and Zod gives you a validator AND the TypeScript type. Parse untrusted data, get back typed data or a detailed error. Works everywhere TypeScript runs.

Fully free. Library-only, no service, no paid tier. Install it and use it. Zod has become the default validation library in the TypeScript ecosystem. Frameworks like tRPC, React Hook Form, and Next.js Server Actions all have first-class Zod integration. If you're building anything in TypeScript, you'll probably end up using it.

The catch: Zod schemas can get verbose for complex nested objects. Performance-sensitive applications (validating thousands of objects per second) might notice. Libraries like Valibot and Typebox compile schemas to faster validators. And Zod 3's error messages are good but not always user-friendly out of the box for form validation. For most apps though, none of this matters. It just works.