Check whether a name is allowed on npm: capitals, scopes, length, core module names
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 16 Oct 2026.npm package names follow rules that are easy to miss: lower case only, at most 214 characters, no leading dot or underscore, URL-safe characters, and no core module names such as http. Old packages may still break some of them, but a new package cannot. Change the name in the box and the result says whether it is fine for a new package, allowed only for old ones, or refused, with npm's own message.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
npm reads package.json strictly in some places and loosely in others: a bad version stops everything, while a missing description only earns a warning. This page checks the file in three layers and shows each separately.
2. What npm says. The warnings and errors npm itself prints for this file, word for word, such as "No repository field." or "Invalid version". They come from rewriting npm's own normalize-package-data, validate-npm-package-name and validate-npm-package-license, and the tests compare the answers with those packages on 80 sample files, 44 names and 54 license strings.
| npm message | What to do |
|---|---|
| Invalid version: "1.0" | Write three numbers, such as 1.0.0 |
| No license field. | Add "license": "MIT" or another SPDX id |
| license should be a valid SPDX license expression | Use the exact id, such as Apache-2.0 |
| scripts['server'] should probably be scripts['start']. | Rename the script to start |
| name can no longer contain capital letters | Use lower case for a new package |
The rest of the article, and all 6 questions about package.json Validator, are on the package.json Validator page.
Not for a new package. Names must be lower case, at most 214 characters, URL-safe, must not start with a dot or underscore, and must not be a Node.js core module such as http. Some old packages have capitals because the rules came later, and npm still installs them, but it refuses a new one.
The version must be a full semantic version with three numbers, such as 1.0.0 or 2.1.0-beta.1. Writing 1.0, latest or an empty string stops npm from reading the package at all. npm accepts a leading v and tidies it away, so v1.2.3 is read as 1.2.3.
No. package.json is strict JSON, which has no comments, so a // or /* line stops npm from reading the file. A common workaround is a key named "//" with a string value; npm ignores keys it does not know. The syntax check here points at the line of the comment.
npm warns when package.json has no repository, because the npm website links to the source code from it. Add "repository": {"type": "git", "url": "git+https://github.com/user/repo.git"}. The warning does not stop anything, and npm skips it entirely for a package marked "private": true.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about package.json Validator and anybody who knows can answer. No account needed.
On the related tools: Readability Checker – Flesch reading ease and grade level, with what to change · JSONPath Evaluator – Evaluate a JSONPath expression and get the matching values and their paths.