Function hoisting is JavaScript behavior that allows a function declaration to be called before its definition appears in the code. This makes traditional declarations easier to organize in some cases. Arrow functions do not hoist in the same way, so they must be defined before use.
How function hoisting works in JavaScript
Function hoisting is a parsing-time behavior, not a runtime trick. When JavaScript processes a function declaration, the declaration is made available for use earlier in the same scope, which is why a call can appear before the function body in source order. This is one reason traditional declarations often feel more flexible than other function forms.
Hoisting is tied to declaration syntax, so it is not the same as simply “moving code up.” The language engine creates the binding before executing the surrounding statements, which means source order and execution order are not always identical. That difference matters when reading code that mixes declarations with expressions or block-scoped code.
Function declarations versus function expressions
The main practical distinction is between declarations and expressions. A named function declaration is hoisted as a callable binding, while a function expression is assigned only when the assignment statement runs. Arrow functions fall into the expression side of that divide, so they do not behave like hoisted declarations.
This is why a line such as callMe() can work before a declaration of function callMe() {}, but not before const callMe = () => {}. With expressions, the variable name may exist in scope, but the function value has not been assigned yet. That timing difference is the source of many “is not a function” errors.
Scope, readability, and code organization
Hoisting can make some programs easier to organize because helper functions can be declared lower in a file while still being callable from earlier code. In larger modules, this can support a top-down reading style where the main logic appears first and supporting declarations follow later.
That convenience has a trade-off. When a file relies heavily on hoisting, it can become less obvious which symbols are actually ready to use at a given point in execution. Developers need to distinguish between what is available because of hoisting and what is merely declared later but not yet initialized.
Common mistakes and edge cases
The most common mistake is assuming every function-like construct hoists the same way. Only function declarations are hoisted as callable functions in the classic sense. Function expressions, including arrow functions, depend on variable initialization rules, so their availability is more limited.
Another source of confusion is that hoisting does not mean every aspect of a declaration is lifted identically. The binding may exist before execution reaches the definition, but assignment behavior still depends on the construct and scope rules. That is why code that seems symmetrical on the page can behave differently at runtime.
Practitioner Guidance
Common misunderstanding: Hoisting is often described as if JavaScript simply “moves functions to the top,” but that shorthand hides important differences between declarations, expressions, and initialization timing. When reviewing code, check whether a function is a declaration or an assigned expression before assuming it can be called early.
Practitioner takeaway: If you want code to be easier to reason about, use hoisting intentionally for declarations you want available early, and avoid relying on it for expressions where execution order should stay explicit.
Related resources from NHI Mgmt Group
- What is the difference between function calling and MCP for enterprise security?
- When does MCP make more sense than function calling?
- What is the difference between application RBAC and function-level permissions for MCP?
- Why do unsalted password hashes remain risky even when the hash function is strong?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org