Key facts
- Plain UTF-8 text; MIME type is text/javascript (RFC 9239), replacing the older application/javascript.
- Can be a classic script or an ES module using import/export; Node decides by the nearest package.json "type" field, and .mjs and .cjs force each mode.
- Production builds are usually bundled and minified as .min.js, often with a .map source map file alongside.
- On Windows, double-clicking a .js file runs it with Windows Script Host rather than opening it, which malware abuses.
- Created by developers and generated by bundlers such as Vite, webpack, esbuild and the TypeScript compiler.
How to open a .js file
Windows
Right-click and choose Open with > VS Code or Notepad++ to view it; do not double-click unknown .js files. Run trusted scripts with node script.js after installing Node.js.
macOS
Open it in VS Code or any code editor, and run it in Terminal with node script.js (install Node.js from nodejs.org or Homebrew).
Linux
View it with less script.js or a code editor, and run it with node script.js after installing Node.js from your distribution or NodeSource.
Common problems and fixes
- "SyntaxError: Cannot use import statement outside a module"
- The file uses ES module syntax but is loaded as a classic script. Add "type": "module" to package.json, rename it to .mjs, or load it with <script type="module"> in the browser.
- "Uncaught SyntaxError: Unexpected token '<'"
- The browser requested a .js file but received an HTML page, usually a 404 or SPA fallback. Open the script URL directly and fix its path or the server's routing.
- "ReferenceError: require is not defined"
- CommonJS require() is used in an ES module or in the browser. Switch to import syntax, rename the file to .cjs for Node, or bundle it for the browser.
- Minified code is impossible to read or debug
- Use the browser DevTools {} pretty-print button or a formatter for a readable copy. Load the matching source map to see original file names and lines.
- Windows warns or antivirus flags a downloaded .js file
- Script files attached to emails or downloads are a common malware vector that runs via Windows Script Host. Do not run it; inspect it in a text editor or delete it.
Often converted to or from: TypeScript, minified JS, MJS / CJS, JSON (data only)