Your files stay on your device

# Third-Party script risk analyzer

Fetch a page and list every script tag it declares with origin, loading strategy, SRI status, and referrer exposure, never executing the page.

Fetch a page or paste its HTML to inventory the scripts.

This inventory reads markup and nothing else. Scripts that a tag manager, an ads slot, or an analytics loader injects while the page runs are invisible here; the honest proxy is the loader tag itself, which does appear. A script list without findings is not an audit: the scan cannot see what the served files contain, who operates the domains, or what the page does while it runs, and it never executes any of it to find out. CORS may also stop the body read of a cross-origin page, in which case view-source and paste mode cover the gap.
Options

## More web & auth tools

- [Subresource integrity](/web/sri)
- [CSP evaluator & builder](/web/csp)
- [Open graph preview](/web/og-preview)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/third-party-script-risk-analyzer
Markdown version: https://nutter.tools/web/third-party-script-risk-analyzer.md
Plain-text version: https://nutter.tools/web/third-party-script-risk-analyzer.txt
Agent index: https://nutter.tools/llms.txt