package.json validator
Check practical package manifest fields locally without resolving, installing, or auditing dependencies.
How it works & useful details
Check practical manifest shapes
The validator reads strict JSON and checks a package name, SemVer version, private/type values, and string entries in scripts and dependency maps. It reports field concerns without changing your manifest.
It does not resolve packages, install anything, contact npm, inspect licenses, or determine whether a dependency is safe, maintained, or compatible.
Private, bounded text processing
Code and markup stay as inert text in this browser. These tools do not execute JavaScript, render HTML, load URLs, install packages, contact registries, or save what you paste.
Regex patterns are limited to 500 characters and test text to 20,000 characters. Formatters and package inspection accept up to 100,000 characters; exports are capped at 200,000 characters.
About this tool
package.json validator checks practical manifest fields such as name, version, scripts, dependencies, and common typos. It is a fast local sanity check before you publish or install something.
The validator does not resolve versions, contact the npm registry, install packages, or perform security auditing. It reports what it can verify from the manifest itself and is explicit about what it leaves unchecked.
How to use it
- Paste the package.json contents.
- Run the validation to see field-level issues and warnings.
- Fix the reported problems in your manifest and validate again.
- Copy the report if you need it for a review or issue.
Worked example
{"name":"My-App","version":"1.0","type":"esm",
"scripts":{"test":1},"dependencies":{"react":"^19.0.0"}}is reported as needing attention, with four issues:
- name should use lowercase npm package-name characters. npm rejects uppercase names for new packages.
- version is not a supported SemVer version. It needs three parts, such as 1.0.0.
- type must be "module" or "commonjs". "esm" is a common mistake that Node.js rejects.
- scripts.test must be a string. Script values are shell commands.
Fields worth getting right
name and version identify a published package. private: true prevents accidental publishing of an application. type decides whether .js files are treated as ES modules or CommonJS, a frequent cause of "Cannot use import statement outside a module" errors. The scripts and dependency maps must contain strings: commands and version ranges.
The validator checks shapes, not the outside world. It does not contact the npm registry, check whether a dependency exists or is safe, audit licenses, or resolve version ranges. Run npm install, npm audit, or your package manager's equivalent for those checks. Use the SemVer range tester to understand what a specific range allows.
Frequently asked questions
Does it verify that dependency versions exist?
No. Registry lookups and semver resolution are out of scope; use the SemVer range tester for range questions.
Is this a security audit?
No. It checks manifest structure only and does not analyze installed packages or vulnerabilities.
What is the size limit?
Up to 100,000 characters of JSON text.
Are comments allowed in package.json?
No. package.json must be strict JSON, so comments and trailing commas make it invalid. A common workaround is a "//" key with a string value.