CDN links, fetched and dated

Search for a library and copy the tag. Every url on this site was actually requested and carries the answer it gave, so you can tell a working link from one nobody has checked.

A url nobody fetched is not a working url

A 404 on a page whose entire purpose is copy-paste is the one failure this site can have, and it is invisible in the data — a broken record looks exactly like a good one. So every url here is requested and the result recorded, and anything unchecked is labelled unchecked rather than quietly presented as fine.

It tells you when the library has no browser build

React 19 dropped its UMD bundles and three.js ships ES modules only. Those links resolve and download perfectly, and then the page breaks with an error naming the wrong culprit. Where a library needs type="module", or needs a bundler entirely, the page says so next to the tag.

The whole index is free and unauthenticated

Search, browse and copy anything, with no account. /libraries.json is the complete dataset including every verification result, with no key and no rate limit beyond ordinary abuse protection. Nothing here is sold, and nothing here is going to be.

Questions

Are these URLs actually checked?

Yes, and that is the whole point of this site. Every url here was requested and the answer recorded — 100 of 102 responded successfully at the last check on 2026-09-03. A url we could not verify is labelled unverified rather than presented as working, and a url that failed says so along with how long it has been failing.

Do I need an account?

No, and there is nothing to buy. There is no sign-in, no key, no rate limit beyond ordinary abuse protection, and no paid tier planned. A CDN index with a paywall is a CDN index nobody uses.

What is an SRI hash and do I need one?

Subresource integrity pins the exact bytes a browser will accept. If the file at that url ever changes, the browser refuses to run it instead of running something you did not review. Use one for anything on a page that handles user data. Only cdnjs publishes hashes, and only for the exact file they computed it from — attaching a hash to a different url blocks the script and looks exactly like the CDN being down.

Why do some libraries say they need type="module"?

Because a growing number of libraries no longer ship a classic browser build at all. three.js and Vue distribute ES modules, so the script tag needs type="module" and the library has to be imported rather than read off a global. Pasting a module build into a plain script tag fails with a syntax error that names the file and not the real cause.