Firebase
Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.
What detecting Firebase tells you about a site
Firebase is Google's backend-as-a-service, and the browser reveals which pieces are in use through its SDK calls: requests to firebaseio.com or firestore.googleapis.com, a firebaseapp.com/web.app hosting domain, or the Firebase JS SDK loaded and configured with a project ID. Detecting it tells you the team offloaded auth, realtime database, storage and sometimes hosting to a managed platform — a buy-not-build choice that favours fast iteration. It points to startups, MVPs, mobile-companion web apps and prototypes more than large bespoke backends.
The detail that matters for Firebase
The specific endpoint narrows the architecture: firebaseio.com is the legacy Realtime Database, while firestore.googleapis.com is the newer Firestore — a quick read on whether the project is older or built on the current default.
Firebase in a real-world stack
When you find Firebase, it rarely travels alone. Frequently alongside Firebase Auth and Cloud Functions, and naturally within the wider Google Cloud and Analytics ecosystem.
About
Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.
Categories: Databases, Development
Quick facts
Detection methodology for Databases
Database technologies that interact with the frontend ship their client SDKs as bundled JavaScript. Prisma's `@prisma/client`, Drizzle's `drizzle-orm`, Supabase's `@supabase/supabase-js`, Firebase's `@firebase/app` — each shows up as a `node_modules/<package>/` path in the sourcemap, with the exact version readable from the embedded `package.json`. The actual database server (Postgres, MySQL, SQLite) is not exposed to the browser by design.
How we detect Firebase
Sourcemap Explorer carries 7 fingerprint signals for Firebase, spread across 4 channels — response header, javascript global, script src url and dom selector. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Server-side fingerprint: the response header reveals the technology behind the page. Visible in DevTools → Network → response headers.
vary: x-fh-requested-host
Window-level global the technology installs on page. Reproducible by typing the path into the DevTools console.
window.firebase.SDK_VERSION = ([\d.]+)$
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
/(?:([\d.]+)/)?firebase(?:\.min)?\.js
/firebasejs/([\d.]+)/firebase
\.gstatic\.com/firebasejs/([\d\.]+)/
firebase(?:Config|io\.com)
A DOM selector that only this technology's pages render. Verified at runtime by the content script.
iframe[src*='.firebaseapp.com/']
FAQ
How do I check if a website is using Firebase?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. Firebase's specific fingerprints here are response header, javascript global, script src url and dom selector, and the popup flags Firebase whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What Firebase version can Sourcemap Explorer detect?
Firebase ships as a hosted databases rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
How much does Firebase cost?
Firebase's pricing model is documented as: freemium, payg. Detection is independent of the pricing tier — Sourcemap Explorer flags the technology by its fingerprints, regardless of which paid plan a site is on. See the official site for the current pricing page.
Where can I read more about Firebase?
Official site: https://firebase.google.com. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Keep reading on Sourcemap Explorer
Practical guides
Detected by Sourcemap Explorer
Open the popup on any page running Firebaseand you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.