What is a .js file?

About the format

A .js file is JavaScript source code — and on Windows, that has a sharp edge that surprises web developers: OUTSIDE the browser, double-clicking a .js file hands it to Windows Script Host, which runs it silently with your user permissions, no sandbox, no browser security model. That's why 'invoice.js' email attachments were a major ransomware delivery vehicle — victims expected a harmless web file and got an unrestricted script. In a development context, .js files are of course everywhere and inert until deliberately run with Node.js or loaded by a web page; the danger is purely the accidental double-click path on Windows. Sensible hardening if you don't need WSH: change the .js file association to Notepad (or disable Windows Script Host outright), so a stray double-click shows code instead of executing it. Reading a suspicious .js is like reading a suspicious .bat: it's text; obfuscation (eval chains, char-code arrays, string reversal) is itself the strongest signal of hostile intent.

How to open a .js file

Is a .js file dangerous?

On Windows, yes via the double-click → Windows Script Host path. Point the association at an editor and the risk collapses.

Related file types