How to use
Choose a package-lock.json, yarn.lock or pnpm-lock.yaml file, or paste its text. The format is detected automatically.
In “Dependency tree”, expand from the direct dependencies or search by name. “Why installed” shows the path from a direct dependency to the package.
In “Duplicates”, check packages installed in more than one version and the packages that pull each version in.
In “Diff”, choose the updated lockfile too and press “Analyze”. Upgrades, downgrades, added and removed packages, sources and integrity changes are listed.
Use “Save CSV” to take every diff row into a spreadsheet.
What it does
Tree that separates direct and indirect
Tells apart dependencies, devDependencies, optionalDependencies and peerDependencies, and expands from the project’s direct dependencies. A peer is shown only where it is installed.
Why it is installed, as a path
Walks back from a package through its dependents and shows the shortest path to a direct dependency.
Detects the format
Reads npm lockfileVersion 1, 2 and 3, yarn v1 and Berry (v2 and later), and pnpm 5, 6 and 9. Unsupported files show the reason.
Diff by semver
Compares versions of the same package with semver and separates upgrades from downgrades. Major upgrades are highlighted as warnings.
Warns on integrity mismatch
Warns when the version is the same but the integrity (hash) differs. Also shows when a source moves to another host.
Fully local
Parsing runs in a Web Worker inside your browser. Neither the lockfile nor its file name is sent or logged.
Use cases
- See how package-lock.json changed after npm install
- Check why an indirect dependency is in the project
- List the versions actually raised in a Dependabot or Renovate update pull request
- Find a library that is installed in several versions
- Check changed sources or hashes in a yarn or pnpm lockfile
Supported formats
Read
Output
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Dependency tree (direct and indirect) | Partial | npm v1 and yarn v1 do not record direct dependencies, so they cannot be told apart |
| Why a package is installed (dependents path) | Supported | Shows one shortest path, not every path |
| Several versions of the same package | Supported | — |
| Diff of two lockfiles (added, removed, upgraded, downgraded) | Supported | — |
| Changes in source (resolved) and integrity | Partial | Sources are not compared when the two lockfiles use different formats |
| Vulnerability lookup | Not supported | It needs an outside connection, so it is not done |
| License review | Not supported | — |
| Analysis from package.json alone | Not supported | Reads the lockfile |
| Installing packages or generating a lockfile | Not supported | — |
| Offline use | Supported | Works without a connection once loaded |
Limits & notes
- Files up to 50 MB each. Pasted text up to 2 million characters.
- A lockfile with more than 100,000 packages is not read.
- On screen: up to 200 search results, 300 duplicated packages and 5,000 diff rows. The CSV contains every diff row.
- Only the lockfile contents are read. The node_modules folder and the versions actually running are not checked.
- npm workspace links are not included in the list.
Privacy & safety
Lockfiles are analyzed only inside your browser. Nothing is uploaded or stored, and file names and contents are never put in analytics logs. Closing the page discards everything.
FAQ
How do I diff two package-lock.json files?
Can it show why a package is installed?
Does it read yarn.lock and pnpm-lock.yaml?
Does it check vulnerabilities or licenses?
What does an integrity change mean?
Is my lockfile sent anywhere?
Related tools
Diff Tool — Text & Code Compare
Paste or drop two versions and see added and removed lines, plus the exact words that changed inside each line. Copy or save the result as a unified patch. Nothing leaves your browser.
JSON Studio — Formatter & Validator
Paste JSON to format, minify or validate it instantly. Errors are shown with the exact line, column and cause, and comments or trailing commas can be auto-repaired. Your data never leaves your device.
YAML / TOML Studio — Validate, Format & Convert
Paste YAML, TOML or JSON to validate, format or convert it. Errors show the exact line and column, and type traps such as “no becomes false” and anything lost in conversion are flagged up front. Your data never leaves your device.
Docker Compose Studio
Convert docker run commands to compose.yaml, or compose.yaml back to docker run. A compose file is checked for syntax, the Compose Specification and common mistakes, and security points worth confirming are listed. Nothing is started or pulled, and your input never leaves your device.
Dockerfile Studio
Paste a Dockerfile to check its syntax, stages and common mistakes. Secret-looking values and points to confirm, such as curl | sh, are listed with line numbers. You can also format it or generate starter files for Node.js, Python, Go, a static site or Java. Nothing is built, and your input never leaves your device.
.env Studio
Paste or drop a .env file to see its keys and values in a table, with duplicates, empty values and syntax problems flagged by line. Values are hidden by default. You can compare a .env with a .env.example, or export an example file, JSON or a Kubernetes Secret. It checks common dotenv syntax, not tool-specific rules such as docker compose variable expansion.
Last updated: