Download websites that use Dojo

Few web technologies work as well as a dating tool as an old JavaScript toolkit. Dojo arrived in 2004, when cross browser inconsistency was the hardest part of front end work, and it solved that problem well enough to end up inside a great many enterprise applications, intranets, admin panels and vendor consoles. Almost none of those were later rewritten. Finding the toolkit on a site today usually means finding an application that was built once, put into production and then left alone.

Version data makes the point sharper than the site count does. We record 85 distinct versions still in circulation, and a commonly detected one is 1.14.1, which sits at the end of the original line rather than in the rewritten modern branch. A spread that wide across a toolkit nobody starts new projects with is not diversity but sediment. Each version marks the moment a particular application stopped being updated.

The BSD licence explains why the sediment persists. Nothing expires, nothing phones home, and no vendor sends a renewal notice that would force a conversation about the framework underneath. An application written in JavaScript against a permissively licensed toolkit keeps serving pages for as long as the server does, which is why the security question is the interesting one. Old client side code accumulates known issues, and the stack around it usually ages at the same rate.

As of October 2026 we detect Dojo on 3,448 sites in the JavaScript libraries category. Detection depends on the loader, on recognisable file paths and on globals left in the page, so a build that bundles and minifies everything into one file can hide the toolkit completely. Modern tooling hides more than old tooling does, which biases the visible population toward exactly the untouched legacy installs described above. Read the count as evidence about a specific and commercially interesting slice rather than as a full installed base.

Where the toolkit turns up is as informative as how often. Public marketing sites rarely use it now, so detections cluster on login screens, customer portals, booking systems, university services and the administrative interfaces of hardware and software vendors. Applications of that kind sit behind a procurement process, serve a captive audience with no say in the matter, and get replaced on a budget cycle measured in years rather than on developer preference. An organisation that appears here has an ageing application in production and, somewhere in it, an unresolved decision about what to do next.

Nobody buys this list looking for early adopters. The buyers are the people who profit from the opposite of newness. Modernisation and migration firms want organisations still running a toolkit whose expertise has become scarce. Security researchers want the population running ageing client side code, sorted by version and country. Competitive analysts and recruiters want to know which sectors never left. All of those are queries over a whole population crossed with version and stack, and a per domain lookup answers none of them, because the value sits in the shape of the set rather than in any single domain inside it.