Skip to content
TextArray1.41.0
100% local

Lockfile inspector

List every package in a lock file with its exact version and whether it's a direct or transitive dependency.

Input
Second lock file (optional, to compare)
Output
Related tools
package.json dependency overviewnewDeveloper tools
SemVer sorter and comparatorDeveloper tools
JSON size analyzernewDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
Lockfile inspector
Paste a package-lock.json, yarn.lock or pnpm-lock.yaml file and this tool lists every package it contains, with its exact resolved version and whether it is a direct dependency (one your project's manifest lists) or a transitive one (pulled in by another package). It's a fast way to audit what actually ships in node_modules, check a pull request that touches the lockfile, or track down where an unexpected version came from.
Pick the format that matches your file, then sort the list alphabetically or by how many other packages depend on it, which surfaces the transitive packages your project relies on most. A filter narrows the output to one name or scope, such as @babel/ or eslint. Turning on duplicate flagging adds a summary of any package name that shows up at more than one version — a common source of a bloated bundle. Choose plain list, a fixed-width table, or CSV for spreadsheets. Paste a second lock file into the optional second box to compare two versions of the same project and see exactly which packages were added, removed or bumped.
The tool handles Windows and Unix line endings the same way. For package-lock.json and pnpm-lock.yaml it reads the project's own recorded dependency list to tell real direct dependencies from ones merely hoisted to the top of node_modules; yarn.lock (classic v1) carries no such record, so its entries are listed without that distinction. Very large lockfiles are processed without freezing the tab, and output beyond 10 MB is capped with a message asking you to filter or compare a smaller file instead.
Everything runs locally in your browser — your lockfile, and the dependency tree it describes, is never uploaded. Copy the result, download it as a .txt file, or send it back into the input to filter further.
FAQ
What's the difference between a direct and a transitive dependency?
A direct dependency is one your project's package.json lists by name. A transitive dependency was pulled in only because one of those packages depends on it.
Why does yarn.lock show every package the same way, without direct or transitive?
yarn.lock (classic v1) doesn't record the project's own dependency list the way package-lock.json and pnpm-lock.yaml do, so there's nothing in the file itself to tell a top-level package from one pulled in transitively.
How does comparing two lock files work?
Paste the old lock file in the main box and the new one in the second field, using the same format for both. The tool lists every package whose version changed, plus anything added or removed.
What counts as a duplicate?
A package name that appears with more than one version in the same lock file — a common cause of a larger bundle when two dependencies each pin an incompatible version of the same library.
Is my lock file uploaded anywhere?
No. Parsing happens entirely in your browser — the file never leaves your device.