Zod: Validate Data, Infer Types

Why it exists

TypeScript types are erased at compile time, leaving your application vulnerable to incorrect data at runtime, like from an API or user input. Zod solves this by providing a single source of truth: a schema that both validates runtime data and generates static TypeScript types, preventing mismatches between your types and your validation logic.

The mental model

Think of Zod as a contract for your data. You write the contract (the schema) once. When data arrives, Zod checks if it fulfills the contract. If it does, Zod gives you back the data, now with a TypeScript type guarantee that it matches the contract. If it fails, Zod throws a detailed error explaining exactly which part of the contract was broken. It bridges the gap between runtime uncertainty and compile-time safety.

How it works

You import Zod and use its functions like z.string(), z.number(), and z.object() to build a schema. This schema is a runtime object, not just a type. To validate data, you call the .parse() method on your schema with the untrusted input. If validation passes, it returns the data, now correctly typed. If it fails, .parse() throws an error. The magic is that TypeScript can infer a static type directly from your runtime schema definition.

When to use it

Use Zod at the boundaries of your application where untrusted data enters. This includes validating incoming API request bodies in a server (like a Next.js API route), parsing form submissions from a user (often with React Hook Form), or checking environment variables on application startup. It's a core part of the tRPC ecosystem for end-to-end typesafe APIs.

When not to use it

For simple, internal-only data transformations where the data source is already trusted and typed, Zod might be overkill. If you're not using TypeScript, you lose its main benefit of static type inference. Zod is not a database schema migration tool; it's for application-layer data validation.

One canonical example

A common use case is validating a user registration form submission on a server. First, define the schema: const UserSchema = z.object({ email: z.string().email(), password: z.string().min(8) }); Then, in your handler, you can parse the input: const validatedData = UserSchema.parse(request.body); Now, you can safely use validatedData.email without any extra type checks, because Zod has guaranteed its shape and type.