Source Map Analyzer
Open a JavaScript source map and see what it exposes: original files, embedded source code, secrets, local paths and bundled packages, with a ZIP of the sources.
Runs in your browser Your input never leaves your device.
Findings
Original files
| File | Size | Kind |
|---|
Bundled packages
Endpoints in the first-party sources
The map is read in your browser and never uploaded. Embedded source code and credentials stay on this page. Use it on maps you are allowed to analyse.
Report a problem with this tool
About this tool
A source map links minified JavaScript back to the original files so debuggers can show readable code. When maps are deployed to production they often embed the full original source, which anyone can download. This tool reads a source map in your browser (a .map file, a pasted map, or a script with an inline data-URL map) and shows what it gives away. It lists the original file tree split into first-party code and packages from node_modules, with the package names and, where the path carries it, versions. It reports whether the original code is embedded and how much, scans the first-party sources for secret-looking values using the same rules as the secret scanner (values are masked in the report), lists TODO notes and credential-like assignments, and points out absolute build paths that reveal user names, such as /Users/name/ or C:\Users\name\. It checks the mappings string by decoding every segment and verifying that source and name indexes exist, and it can pull endpoints out of the first-party sources with the endpoint extractor. Click any file to read its embedded content, and download the sources as a ZIP; entry names are made safe so a hostile map cannot write outside its folder. Indexed (sectioned) maps are listed but their section mappings are not decoded. Results were compared with maps from real esbuild builds, using @jridgewell/sourcemap-codec and Mozilla's source-map for the mapping counts and Python's zipfile to open the archive. Maps are read in your browser and never uploaded, and nothing is requested: a script that points to a separate map file is explained, not fetched.
How to use it
- Download the .map file (or the script with an inline map) and load it here, or paste the map JSON.
- Read the findings, starting with embedded source code and secrets.
- Click files to read them, filter by name, and include packages if you want them listed.
- Download the sources as a ZIP, or extract endpoints from the first-party code.
Common problems
- It says the script points to a separate map file
- Download that .map file yourself and load it. This tool never fetches anything.
- No source code is shown
- The map has file paths but no sourcesContent. You still get the file tree, packages and path leaks, but no code.
- A package has no version
- Versions appear only when the path carries them (for example a pnpm folder name). Plain node_modules paths show the name only.