PayPal
PayPal is an online payments system that supports online money transfers and serves as an electronic alternative to traditional paper methods like checks and money orders.
What detecting PayPal tells you about a site
PayPal appears on checkout and donation flows as a payment option, detectable from its JS SDK loaded off paypal.com/paypalobjects.com, the rendered Smart Payment Buttons, and a popup or redirect to PayPal's hosted approval flow. Its presence tells you the merchant wants the trust and reach of a household-name wallet — PayPal lowers friction for buyers who would rather not hand a card to an unfamiliar site. It spans everything from small shops and nonprofits to large marketplaces, so it is a broad signal of consumer-facing commerce more than a niche architectural one.
PayPal in a real-world stack
When you find PayPal, it rarely travels alone. Usually offered alongside a card processor (Stripe, Braintree, which PayPal owns) and increasingly BNPL options on the same checkout.
About
PayPal is an online payments system that supports online money transfers and serves as an electronic alternative to traditional paper methods like checks and money orders.
Categories: Payment processors
Quick facts
Detection methodology for Payment processors
Payment SDKs identify themselves through their script src URL (`js.stripe.com/v3/`, `www.paypal.com/sdk/js`, `cdn.adyen.com/`) and runtime globals (`Stripe`, `paypal`, `AdyenCheckout`). We surface the exact SDK version via the sourcemap when shipped — Stripe Elements 14.x vs 5.x, PayPal Checkout v5 vs v6 — which matters for security and compliance work much more than the categorical 'they use Stripe' answer.
How we detect PayPal
Sourcemap Explorer carries 13 fingerprint signals for PayPal, spread across 5 channels — response header, meta tag, javascript global, script src url and dom selector. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Server-side fingerprint: the response header reveals the technology behind the page. Visible in DevTools → Network → response headers.
content-security-policy: \.paypal\.com
<meta> tag injected into the document. Visible by viewing the page source.
<meta name="id" content="in-context-paypal-metadata">
Window-level global the technology installs on page. Reproducible by typing the path into the DevTools console.
window.PAYPAL
window.__paypal_global__
window.checkout.enabledpayments.paypal = ^true$
window.enablePaypal
window.paypal
window.paypalClientId
window.paypalJs
window.wc_ga_pro.available_gateways.paypal
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
paypalobjects\.com
A DOM selector that only this technology's pages render. Verified at runtime by the content script.
button
iframe[src*='paypal.com'], img[src*='paypal.com'], img[src*='paypalobjects.com'], [aria-labelledby='pi-paypal'], [data-paypal-v4], [data-paypal-commerce-button], [data-paypal-smart-button-version], img[alt*='PayPal']
FAQ
How do I check if a website is using PayPal?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. PayPal's specific fingerprints here are response header, meta tag, javascript global, script src url and dom selector, and the popup flags PayPal whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What PayPal version can Sourcemap Explorer detect?
PayPal ships as a hosted payment processors rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
Is PayPal a SaaS or self-hosted?
PayPal is offered as a hosted SaaS product. Detection runs against the JavaScript SDK or asset-URL fingerprints the platform ships into pages.
How much does PayPal cost?
PayPal's pricing model is documented as: payg. Detection is independent of the pricing tier — Sourcemap Explorer flags the technology by its fingerprints, regardless of which paid plan a site is on. See the official site for the current pricing page.
Where can I read more about PayPal?
Official site: https://paypal.com. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Keep reading on Sourcemap Explorer
Practical guides
Alternative tools
Detected by Sourcemap Explorer
Open the popup on any page running PayPaland you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.