Free JavaScript Validator - Acorn Syntax Check, Never eval

The dangerous way to "validate" JavaScript in a web page is to execute it. eval, new Function, and a hidden iframe will happily run whatever you paste - including token stealers and infinite loops. This page does none of that. It uses Acorn to build an abstract syntax tree and then stops. The default const x = 1; parses. const x = is a syntax error with a location. A runtime bug such as calling a method on undefined still parses. That is expected, because parse is not execute.

Source type tries module first so import and export work, then falls back to script for classic files. TypeScript annotations fail on purpose: Acorn is a JavaScript parser, not a TS compiler. ESLint rules - unused variables, eqeqeq, React hooks - are out of scope. If you need a linter, run ESLint in your repo. If you need a type checker, run tsc. If you need to know whether a snippet is grammatically JavaScript, stay here.

Acorn is configured with ecmaVersion: "latest". That covers current ECMAScript syntax the library ships. Stage-0 proposals that need plugins, JSX unless you pre-transform it, and decorators that are not in the grammar Acorn knows will fail. A failure here means "this is not plain modern JS according to Acorn," not "this will never run in a bundler plugin."

The loop is short on purpose:

1. Paste JavaScript - Drop a function, a module, or a one-liner into the left panel. Click Sample to restore const x = 1; for a passing parse.
2. Read parse success or the Acorn error - const x = fails with a line and column. import statements parse as module sourceType. Classic scripts that are not modules fall back to script.
3. Do not expect runtime checks - Missing variables, null.foo, and infinite loops are execution problems. This page will not catch them.
4. Copy or clear - Copy the report. Clear erases the editor and the draft under javascript-validator-input. Nothing is uploaded and nothing is executed.

Desktop users resize with the unique javascript-validator-split-track handle. That class is exclusive so this page cannot collide with the CSS or JSON5 splitters. Fullscreen is for long Acorn messages. Width is stored in javascript-validator-panel-width.

Online "JS compilers" that run pasted code are a different product category and a different threat model. This site's rule is parse only. If you need to run untrusted JavaScript, do it in an isolated engine you control - not in the page that also holds your logged-in session.

• Incomplete expressions. const x =, return in the wrong context, and a missing operand after an operator.
• Unclosed brackets, braces, and parentheses. Template literals and JSX-looking < tokens are frequent sources of confusion.
• Reserved words used as identifiers in strict/module code, or illegal await outside async.
• TypeScript or Flow annotations. const x: number = 1 is not JavaScript. Strip types first.
• JSX. <div /> is not in core ECMAScript. Transform with a compiler, then parse the output if you want a JS AST check.
• Stage-0 syntax that needs a Babel plugin. Acorn latest is not Babel latest.

Search results still mix three tools: syntax checkers, REPLs, and sandboxed runners. A REPL is useful when you want 2 + 2 to print 4. It is the wrong default for pasting a coworker's unknown snippet. Execution can read cookies, hit APIs from your origin if the page is careless, lock the event loop, or simply throw in a way that looks like a "validation error" when the real issue is a missing DOM node. This page refuses that category. Acorn returns a tree or an exception. Side effects are not on the menu.

new Function(source) is eval with extra steps. An iframe with srcdoc is still an engine. Web Workers still run the script. None of those appear in this client. If you see a green check, it means the grammar matched, including import when module mode succeeded. It does not mean the module graph exists, that Node can resolve node:fs, or that a browser would grant permissions.

Strict mode is implied for modules. A classic script without "use strict" allows some sloppy-mode syntax that modules reject. The fallback to script sourceType is how those files still pass. If you are writing ESM for the browser, a pass in module mode is the one that matters. If both fail, fix the syntax before you argue about strict mode.

Hashbangs, shebangs, and #! /usr/bin/env node on line one are a Node convenience. Acorn latest may or may not accept them depending on options. If a CLI file fails here and runs in Node, strip the shebang for the check or treat this page as a browser-JS grammar gate, not a Node loader. Likewise, TypeScript import type and satisfies are not JavaScript. Downlevel with tsc or a bundler, then paste the emit if you want a JS parse.

Large minified bundles will parse slowly and tell you almost nothing useful. Prefer a function, a module, or a test file. The unique storage key keeps that snippet on this machine only. It is still not a pastebin for proprietary source.

Parser errors point at the token where recovery failed, which is not always the token you forgot. A missing { on a function can surface as an unexpected return on a later line. A missing comma in an object literal can look like an unexpected identifier on the next property. Read the message, then look backward for the incomplete construct. That is the same skill you use in tsc and in ESLint parser failures.

Automatic semicolon insertion (ASI) is a grammar feature, not a linter rule. return followed by a newline then an object literal is a classic ASI footgun: the parser may treat the return as complete and then choke on the brace. This page will report whatever Acorn decided. It will not explain ASI in the error string. If a snippet "looks fine" and fails, inspect newlines after return, throw, and yield.

Template literals nest braces in expressions. An unclosed ${ looks like a generic unexpected end of input. Regular expression literals versus division are another classic tokenizer fork: a / /b/ versus a/b. If you are debugging a regex, the regex testing tool is a better workbench than reading Acorn's token stream.

async, await, yield, and using (where supported) are contextual. Using await at top level is legal in modules and illegal in classic scripts. That is one reason module is tried first. A file that uses top-level await will fail the script fallback and still pass as a module. The badge on the result panel tells you which mode won.

Copy the report when you file a ticket. A line and column plus "the code was not executed" is a better bug report than "JS doesn't work." Clear when you are done so the next paste is not mixed with yesterday's function. The 30-day draft is a convenience for refresh, not a version control system.

Unicode identifiers, private name fields (#foo), and class static blocks are modern JS that Acorn latest should accept. If a proposal is still behind a Babel plugin, it will fail here until it lands in the grammar. That lag is a feature when you want to know what a stock engine will parse without your team's plugin list. Document the plugin when you must ship syntax this validator rejects.

Source stays in this browser. The draft key is javascript-validator-input (30 days). Panel width is javascript-validator-panel-width. Those names are unique so a CSS draft cannot overwrite your script. Clear deletes the source. There is still no good reason to paste private production bundles or secrets into a shared computer.

Because execution is off the table, a pasted fetch to your API is not sent. A pasted while (true) {} cannot freeze the tab through this tool - Acorn builds a tree and returns. (A huge file can still stall the parser; keep inputs modest.)