Editing JavaScript

{{Cleanup}}
{{ToneWarning}}
{{ProductCargo
|Company=
|ReleaseYear=1995
|InProduction=Yes
|Category=Software
|Website=https://openjsf.org/,https://tc39.es/ecma262/multipage/
|Description=A high-level programming language that's also the "lingua franca of the web"
|Logo=JavaScript-logo.png}}

'''[[wikipedia:JavaScript|JavaScript]]''' '''(JS)''', not to be confused with '''[[wikipedia:ECMAScript|ECMAScript]] (ES)''', is a [[wikipedia:Programming_language|programming language]] and core technology of [[wikipedia:World_Wide_Web|the Web]], alongside [[wikipedia:HTML|HTML]] and [[wikipedia:CSS|CSS]]. It was created by [[wikipedia:Brendan_Eich|Brendan Eich]] in 1995.<ref>https://exploringjs.com/es5/ch04.html</ref> As of 2025, the overwhelming majority of [[wikipedia:Website|websites]] (98.9%) uses JS for [[wikipedia:Client_(computing)|client]]-side [[wikipedia:Web_page|webpage]] behavior.<ref name="deployedstats">{{cite web |title=Usage Statistics of JavaScript as Client-side Programming Language on Websites |url=https://w3techs.com/technologies/details/cp-javascript |access-date=2024-02-27 |website=W3Techs }}</ref> It's even used on the [[wikipedia:Server_(computing)|server]]-side (see [[wikipedia:Node.js|Node.js]]). JS is also known to enhance the [[wikipedia:User_experience|user-experience]] (UX). The [[wikipedia:World_Wide_Web_Consortium|World Wide Web Consortium]] (W3C) provides comprehensive guidelines for such purposes.<ref>https://www.w3.org/wiki/The_principles_of_unobtrusive_JavaScript</ref>

For the entirety of this article (unless stated otherwise) the terms "JavaScript" and "JS" will be defined as "ECMAScript with access to [https://developer.mozilla.org/en-US/docs/Web/API Web APIs]" or "ES+WebAPI" for short.

==Consumer-impact summary==

*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.
*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software|available]], which is typically the case of [[wikipedia:Proprietary_software|proprietary software]].<ref>{{Cite web |last=Gross |first=Carson |date=2023-09-21 |title=The #ViewSource Affordance |url=https://htmx.org/essays/right-click-view-source/ |url-status=live |archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ |archive-date=2026-02-28 |access-date=2026-03-24 |website=</> htmx ~ Essays}}</ref>
*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web |title=Learn how identifiable you are on the Internet |url=https://www.amiunique.org/ |access-date=2026-03-19 |website=Am I Unique ?}}</ref>
*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web |title=Everyone has JavaScript, right? |url=https://www.kryogenix.org/code/browser/everyonehasjs |url-status=live |archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html |archive-date=2026-03-16 |access-date=2026-03-19 |website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> John Gruber says that JS shouldn't be part of browsers;<ref>{{Cite web |last=Gruber |first=John |date=2017-06-22 |title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' |url=https://daringfireball.net/linked/2017/06/22/navistone-form-data |url-status=live |archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data |archive-date=2026-03-19 |access-date=2026-03-20 |website=Daring Fireball}}</ref><ref>{{Cite web |last=Gruber |first=John |date=2017-06-27 |title=Using Today's Web Without JavaScript |url=https://daringfireball.net/linked/2017/06/27/web-without-javascript |url-status=live |archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript |archive-date=2026-03-19 |access-date=2026-03-20 |website=Daring Fireball}}</ref> one way that would work is by turning JS into an [[wikipedia:Browser_extension|extension]] or [[wikipedia:Plug-in_(computing)|plug-in]] that the user willingly installs.<!-- This proposal is just to sugarcoat John's bold/"based" opinion, without putting words in his mouth. I'm not sure how else to reword this -->
*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging|debugging]] and [[wikipedia:Reverse_engineering|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript|TypeScript]] and [[wikipedia:ESLint|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug|bugs]].

==How it works==
Whenever a user visits a webpage, an average web-browser will execute the JS code it finds in <code><script></code> [[wikipedia:HTML_element|tags]]. This code could do anything from updating part of the [[wikipedia:Document_Object_Model|DOM]]-tree only when the user requests it, to showing a [[wikipedia:Pop-up_ad|popup/popunder]].

When JS tries to access a "privacy-sensitive" API (such as the microphone) the browser pauses it until the user has granted access for the first time. This is typically done on a per-domain basis. However, as mentioned earlier, many other APIs don't need to ask permission before fetching data.

It's worth noting that JS has a privileged position, relative to [[wikipedia:WebAssembly|Wasm]], because of its first-class access to Web APIs.

==Why it is a problem==

===Tracking===
Many webpages (and even entire websites), force the user to keep JS enabled, otherwise they break or deliberately refuse to work. CSS stylesheets combined with HTML<!-- TO-DO: cite `<portal>`. I remember an entire website that demos/showcases the Portal API, but can't find it. `<portal>` fixed the fundamental problem that SPAs try to solve, with minimal (or zero!) JS -->should be fine with most basic websites or webpages that do not need complex client side interaction. 

JS makes it harder for [[Ad block|ad-blockers]] to block ads, since it can be used to make overly-dynamic ads. The data collected by malicious JS makes it trivial to serve [[Personalized Ads|personalized ads]], even across unrelated sites. Some sites collect so much data that they are indistinguishable from [[spyware]] (see also [[wikipedia:Keystroke_logging|key-logging]]).<ref>{{Cite web |last=Hill |first=Kashmir |date=2017-06-20 |title=Before You Hit ‘Submit,’ This Company Has Already Logged Your Personal Data |url=https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 |url-status=live |archive-url=https://web.archive.org/web/20260220091637/https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 |archive-date=2026-02-20 |access-date=2026-03-19 |website=Gizmodo}}</ref>

===Security===
Browser-engine developers (such as [[Google]] and [[Mozilla]]) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web |last=Norman |first=Johnathan |date=2021-08-04 |title=Super Duper Secure Mode |url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ |url-status=live |archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode |archive-date=2026-02-18 |access-date=2026-03-19 |website=Microsoft Browser Vulnerability Research}}</ref> Some examples of this are as follows:

*[[wikipedia:Cross-site_scripting|XSS]], which [[wikipedia:NoScript|NoScript]] tries to mitigate
*[[wikipedia:Arbitrary_code_execution|Arbitrary code execution]] and [[wikipedia:Code_injection|code injection]]. Typically caused by <code>[https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval eval]</code> (part of ES), but there are Web APIs (such as <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout setTimeout]</code> and <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setInterval setInterval]</code>) that can be misused as well.
*Remote code execution. This is used by hackers and crackers to build [[wikipedia:Botnet|bot-nets]] for [[wikipedia:Ddos#Distributed_DoS|DDoS]] or [[wikipedia:Cryptocurrency|crypto]]-mining, but it's mostly used for spyware since it can hide more easily.

===Scraping===
Since the rise of big LLM's many brokers have started offering scraping services for companies that want more training data for their AI. and to that end a lot of headless browser agents have begun to scrape (collect a sites information provided) even with the users robots.txt provided as a common standard to tell agents not to do so. this has lead to many forums and websites that had not used JS before to start implementing CAPCHAS or Anubis to prevent increased overhead and bandwidth costs.

==Incidents==
This is a list of all consumer-protection incidents related to this technology. Any incidents not mentioned here can be found in the [[:Category:{{PAGENAME}}|{{PAGENAME}} category]].

===Google Search requires JS (2025)===
In January 2025, Google's web-search engine mandates that user-agents must have JS enabled. Google's justification was that it's a defense mechanism against abusive bots (see also [[Deceptive language frequently used against consumers]]).<ref>https://techcrunch.com/2025/01/17/google-begins-requiring-javascript-for-google-search/</ref><ref>https://daringfireball.net/linked/2025/01/18/google-search-javascript</ref><ref>https://serpapi.com/blog/google-now-requires-javascript/</ref> However, some people claim that it's an invalid justification.<ref>https://blog.jim-nielsen.com/2025/javascript-required/</ref>

==External links==

*[https://libredirect.github.io/faq.html LibRedirect explaining why it exists], and how [[Google Chrome]]'s MV3 limits it
*Google being anti-competitive towards [[Firefox]]: https://github.com/uBlockOrigin/uBlock-issues/discussions/3240
*[https://github.com/iam-py-test/my_filters_001/blob/fc5f61eff0b0d821cb426bea76b18937072bc390/no-js-warnings.txt Websites that nag users to enable JS, even when it provides negligible value]
*Discord being extremely bloated to the point of crashing when opening Developer-tools: https://github.com/Rudxain/uBO-rules/blob/42220bd4f80052ee15136dff7269df19529c43ec/rx.ubo#L3-L19. This is not the fault of bloated JS, it's likely a bloated DOM-tree, but discord only bloats the DOM when JS is enabled.
*[https://www.slideshare.net/slideshow/enough-withthejavascriptalready/23262138 "Enough with the JavaScript already!"]
*[https://eev.ee/blog/2016/03/06/maybe-we-could-tone-down-the-javascript "Maybe we could tone down the JavaScript"]
*[https://www.kryogenix.org/code/dont-need-that-js "You really don't need all that JavaScript, I promise"]
*[https://jakearchibald.com/2013/progressive-enhancement-still-important "Progressive Enhancement Still Important"]
*https://gomakethings.com/why-progressive-enhancement-still-matters/
*https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation
*[https://youtu.be/xE9W9Ghe4Jk "Shipping a button in 2026…"], by Kai Lentit. This illustrates the burnout and fatigue software developers can experience on a daily basis
*[https://grugbrain.dev/ HTMX developer advocating for less JS]
*[https://idlewords.com/talks/website_obesity.htm "Web Obesity Crisis"]
*[https://danluu.com/web-bloat/ "How web bloat impacts users with slow connections"]
*[https://tonsky.me/blog/js-bloat JS bloat (2024)]
*[https://tonsky.me/blog/disenchantment How JS makes web apps more unstable]
*[https://www.gnu.org/philosophy/javascript-trap.html GNU/FSF explaining why JS takes freedom away]
*[https://www.gnu.org/philosophy/wwworst-app-store.html GNU/FSF explaining why "web apps" shouldn't exist]. '''WARNING''': contains overzealous claims! ([https://github.com/Rudxain/blog/blob/main/post/re_twwwas.md according to Rudxain]). Related: [[wikipedia:Local-first_software|Local-first]]
*[https://www.smashingmagazine.com/2018/05/using-the-web-with-javascript-turned-off/ "I Used The Web For A Day With JavaScript Turned Off"]
*[https://tobyho.com/2010/03/11/how-much-of-the-web-actually/ "How Much of the Web Actually Work Without Javascript"]
*[https://github.com/Rudxain/blog/blob/main/post/js-abuse.md More sources] (''TO-DO'')

==See also==

*[[Electron]]

==References==
{{reflist}}

[[Category:{{PAGENAME}}]]