Compare package.json Files Online

Paste two package.json files. See which dependencies changed, what versions bumped, and what scripts were modified.

🔒 100% private — runs entirely in your browser

or try sample data

What is package.json Diff?

package.json Diff compares two package.json files and shows you exactly which dependencies changed, what versions bumped, and which scripts or settings were modified. It's essential for reviewing npm updates, auditing dependency changes, and tracking project configuration drift.

When you run npm update, npx npm-check-updates, or merge a Dependabot PR, the package.json changes can be subtle — a caret range might shift from ^18.2.0 to ^19.0.0, a devDependency might move to dependencies, or a package might be replaced entirely. This tool surfaces every change with color-coded highlighting.

Paste your package.json files (before and after). The tool performs deep JSON comparison, catching changes in nested objects like scripts, dependencies, devDependencies, engines, and all other fields. Everything runs client-side — your data stays in your browser.

package.json Comparison — Common Scenarios

Reviewing npm update changes

# Before npm update
"dependencies": { "react": "^18.2.0", "next": "^13.4.0"
} # After npm update
"dependencies": { "react": "^19.0.0", "next": "^15.0.0"
} # The diff highlights both version bumps as modified fields,
# making it easy to spot major version changes that may
# include breaking changes.

Major version bumps (18 to 19, 13 to 15) often include breaking changes. The diff makes these immediately visible.

Tracking dependency additions and removals

# Before: using moment.js
"dependencies": { "moment": "^2.29.4", "lodash": "^4.17.21"
} # After: migrated to date-fns, removed lodash
"dependencies": { "date-fns": "^3.0.0"
} # Diff shows:
# - moment: removed (red)
# - lodash: removed (red)
# - date-fns: added (green)

Package replacements (moment to date-fns) show as separate remove + add operations, making migration tracking straightforward.

Script modifications

# Before
"scripts": { "test": "jest", "dev": "next dev"
} # After
"scripts": { "test": "vitest", "dev": "next dev --turbo", "lint": "eslint ."
} # Diff shows test runner change, turbo flag addition,
# and new lint script.

Script changes can affect CI/CD pipelines. Review these carefully, especially test runner swaps that may require configuration changes.

package.json Comparison Gotchas

Semver range notation

A change from ^18.2.0 to ^19.0.0 looks small but represents a major version bump with potential breaking changes. The caret (^) allows minor/patch updates, while tilde (~) only allows patches. Pay attention to range prefix changes as well as version numbers.

devDependencies vs dependencies

Moving a package from devDependencies to dependencies (or vice versa) shows as a removal from one section and addition to another. This matters for production builds — devDependencies aren't installed with npm install --production.

Lock file drift

package.json specifies semver ranges, but the actual installed versions are pinned in package-lock.json or yarn.lock. Two identical package.json files can resolve to different installed versions. For exact version comparison, diff the lock files using the Text Diff tool.

Frequently Asked Questions

How do I compare two package.json files?

Paste the contents of both package.json files into the two panels and click Compare. The tool performs deep JSON comparison and highlights every changed field — dependencies, scripts, version, and all other properties.

Can I spot which dependencies changed versions?

Yes. Version changes are highlighted as modified fields in orange, showing both the old and new semver ranges. New dependencies appear in green, removed ones in red.

Does this handle devDependencies and peerDependencies?

Yes. The tool compares the entire JSON structure, including all dependency types (dependencies, devDependencies, peerDependencies, optionalDependencies), scripts, engines, and every other field.

Is my package.json data safe?

Yes. This tool runs entirely in your browser. Your package data, including any private registry URLs or custom configurations, is never sent to any server.

Can I use this to review Dependabot PRs?

Yes. Copy the package.json before and after the Dependabot changes and paste them here. The diff makes it easy to see all version bumps at a glance and decide whether to merge.

What about monorepo workspace configurations?

You can compare individual package.json files from any workspace. For the root package.json with workspace definitions, all fields including workspaces arrays are compared.