@firebase/app
The primary entrypoint to the Firebase JS SDK
About
The primary entrypoint to the Firebase JS SDK
What detecting @firebase/app tells you about a site
@firebase/app is the modular core of the Firebase v9+ SDK, the piece every other Firebase service initialises against, so its presence confirms the app is built on Google's Firebase platform: likely Auth, Firestore, Realtime Database, Storage or Cloud Functions. Crucially, the scoped @firebase/* package layout (rather than the older monolithic firebase import) signals a modern, tree-shakeable modular setup, which marks a more current build that cares about bundle size. It strongly implies a serverless, BaaS-style architecture where the client talks directly to Google's backend.
Why the exact @firebase/app version matters
The Firebase modular SDK (v9 and onward) was a ground-up redesign moving from namespaced firebase.auth() chains to tree-shakeable function imports, so the major version tells you whether the app uses the legacy or modern API and how much dead Firebase code the bundle drags in. Later majors also track changing service behaviours and security defaults worth dating.
@firebase/app in a real-world stack
When you find @firebase/app in a bundle, it rarely travels alone. Other @firebase/* packages such as @firebase/auth and @firebase/firestore.
Quick facts
npm install @firebase/appWhat @firebase/app pulls in
@firebase/app declares 5 direct dependencies — each one also rides into any bundle that ships @firebase/app, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .
How Sourcemap Explorer detects @firebase/app
@firebase/app ships as v0.16.4, published 2026-10-21 and carries 5 direct dependencies, 3,772 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when @firebase/app rides inside a deployed bundle — here is how the detection works.
We catch @firebase/app from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/@firebase/app/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.
- 1
Confirm the site exposes sourcemaps
In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `@firebase/app` paths live.
- 2
Find the package in the bundle
Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/@firebase/app/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/@firebase/app/package.json` gives you the exact installed version.
- 3
Read the version directly from package.json
Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/@firebase/app/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.
Recent versions
@firebase/app README
Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.
@firebase/app
This package coordinates the communication between the different Firebase components
This package is not intended for direct usage, and should only be used via the officially supported firebase package.
FAQ
What is @firebase/app used for?
The primary entrypoint to the Firebase JS SDK
How can I tell if a website is using @firebase/app?
Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `@firebase/app` from two complementary signals: `node_modules/@firebase/app/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.
How do I find out which version of @firebase/app a website is running?
Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `@firebase/app/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/@firebase/app/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 0.16.4, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.
What is the latest version of @firebase/app?
0.16.4, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.
Is @firebase/app actively maintained?
Very actively maintained — the last release shipped within the past three months. The last published release was 2026-10-21. Source code: https://github.com/firebase/firebase-js-sdk.
Where can I read more?
Project homepage: https://github.com/firebase/firebase-js-sdk#readme. Source code: https://github.com/firebase/firebase-js-sdk. Published on npm: https://www.npmjs.com/package/@firebase/app. Licensed as Apache-2.0.
Detected by Sourcemap Explorer
When a bundle ships sourcemaps, we read the embedded package.json for @firebase/app and report the precise version (the registry's latest is v0.16.4, published 2026-10-21; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.