Download websites that use Node.js

About Node.js

Server-side JavaScript changed who builds back ends more than it changed how they are built, and that is the useful thing about detecting Node.js. A site running it was almost certainly assembled by people who also wrote its front end, which implies a single team rather than a handoff between specialisms. As of September 2026 we detect it on 3,608,623 sites.

That team structure is the signal worth acting on. Organisations with unified front and back end teams buy differently: fewer, broader tools, more emphasis on developer experience, faster evaluation cycles and a strong preference for things that install without a procurement conversation. If that describes your product, this population is where it lands.

The count also deserves a measurement caveat. A back end announces itself only when something in the response path chooses to say so, and a great many deployments sit behind a proxy that strips or rewrites exactly those signals. Our figure is therefore a floor rather than a census, and absence here is considerably weaker evidence than presence. We would rather publish a defensible floor than a confident number we cannot support.

Read alongside the rest of the stack, it becomes much more discriminating. This runtime under a static site generator describes a marketing site. Under an application framework with an authentication layer it describes a product. Behind a commercial proxy with a build pipeline attached it describes a funded engineering team. Those are three different customers sharing one detection.

United States accounts for 2,295,246 of detections and the .com zone leads, following where engineering-led companies concentrate rather than any regional preference for the runtime.

The webatla export puts every co-detected technology on the same row as the domain, rebuilt daily, so separating those three customers is a local filter rather than a research project.

The measurement caveat has a practical workaround worth describing, because it turns a limitation into a method. Even when the runtime itself is hidden, the framework above it and the build tooling around it frequently leave signatures in the delivered assets. So a site can be identified as belonging to this ecosystem without the runtime ever announcing itself, and combining those indirect signals recovers a substantial part of the population that a header-based approach would miss.

That is the general argument for extracting everything rather than a primary label. Any single detection method has blind spots, and the blind spots differ. Holding all of them on one row means an analysis can route around whichever signal happened to be suppressed on a given site, which is not possible when a service returns one answer per query.

The OpenJS Foundation stewards it under the MIT license and it has been available since 2009. Because it is installed rather than subscribed to, no vendor holds a list of who runs it, and the only route to a population figure is direct measurement.