JavaScript

• 1. Introduction

  ›

  JavaScript was born in ten days. In the spring of 1995, Brendan Eich sat down at Netscape to build a scripting language for the web. His employer wanted something for everyday people, not just professional programmers. The goal, as Netscape put it, was a language to help nonprogrammers create dynamic, interactive websites. What emerged from those ten frantic days would eventually become the most widely used programming language on GitHub, running on 98.9% of all websites as of 2025. But the path from that rushed prototype to global ubiquity was anything but smooth. It ran through a bruising browser war, a decade of stagnation, a corporate trademark dispute that still isn't fully resolved, and a grassroots renaissance sparked by a single white paper. How did a language conceived as a marketing move end up holding the web together?

• 2. A Name Borrowed from Java

  ›

  Netscape's browser, Navigator, was released in 1994 and quickly became the most-used browser in the world. The web it served was entirely static. Once a page loaded, nothing on it could change. Netscape wanted to fix that. Their first plan was to embed Sun Microsystems' Java language directly into Navigator. They also hired Eich to embed the Scheme language. Management eventually settled on a third path: Eich would write a brand-new language, one that looked like Java but was simpler and more accessible. When it first shipped as part of a Navigator beta in September 1995, it was called LiveScript. By December, for the official release, it had been renamed JavaScript. Eich himself later described the name as a marketing ploy by Netscape, trading on Java's popularity during the dot-com boom. That borrowed name created a confusion that persists to this day. Java was developed by James Gosling of Sun Microsystems, while JavaScript was Eich's creation at Netscape. The two share a C-like syntax and some naming conventions, but Java has static typing while JavaScript's typing is dynamic, Java loads from compiled bytecode while JavaScript loads as human-readable source code, and Java did not support functional programming until Java 8, while JavaScript supported it from the start, drawing influence from Scheme.

• 3. The Browser War Years

  ›

  Microsoft debuted Internet Explorer in 1995, the same year as Navigator, and the rivalry between the two browsers shaped the early web for a decade. Rather than adopt JavaScript, Microsoft built its own compatible interpreter called JScript, releasing it in 1996 alongside initial CSS support and HTML extensions. The implementations diverged enough that developers couldn't reliably make a single site work well in both browsers. That friction produced the era of "best viewed in Netscape" and "best viewed in Internet Explorer" badges scattered across the web. Netscape moved to address the fragmentation in November 1996, submitting JavaScript to Ecma International as the basis for a shared standard. The first ECMAScript specification followed in June 1997. ECMAScript 2 arrived in June 1998, ECMAScript 3 in December 1999, and work on ECMAScript 4 began in 2000. Then the standardization effort stalled. By the early 2000s, Internet Explorer commanded 95% of the browser market. Microsoft stopped collaborating on the Ecma work, and ECMAScript 4 was shelved. JScript, not the standard, became the de facto rule for client-side scripting on the web.

• 4. Ajax and the Renaissance

  ›

  In 2005, Jesse James Garrett released a white paper in which he coined the term Ajax. It described a set of techniques, with JavaScript at the backbone, that allowed web pages to load fresh data in the background without a full page reload. The effect was electric. Developers who had grown used to static, clunky pages suddenly saw a path to applications that felt alive. Open-source libraries multiplied around the idea: jQuery, Prototype, Dojo Toolkit, and MooTools all emerged from this period. Mozilla, the successor to Netscape, released Firefox in 2004, winning back significant market share from Internet Explorer and breaking its near-monopoly. Then in 2008, Google launched Chrome with the V8 JavaScript engine, which introduced just-in-time compilation and ran JavaScript noticeably faster than any competitor. The other browser makers had to overhaul their own engines to keep pace. In July 2008, representatives from the competing camps met in Oslo. By early 2009, they had agreed to merge their work into a single forward-looking specification. The result, ECMAScript 5, was released in December 2009. Ryan Dahl then released Node.js that same year, combining V8 with an event loop and I/O APIs to let JavaScript run as a full server-side language for the first time.

• 5. JavaScript Beyond the Browser

  ›

  Node.js changed what JavaScript could be used for. By 2018, millions of developers were running Node, and npm had accumulated more modules than any other package manager in the world. The runtime itself processes messages from a queue one at a time, with each message fully handled before the next begins, a model described as "run to completion". That event loop makes it non-blocking: the language can process a mouse click while waiting for a database query to return, without freezing. Beyond Node, frameworks like Electron, Cordova, and React Native carried JavaScript into desktop and mobile applications. Adobe Acrobat uses JavaScript to support PDF scripting. GNOME Shell extensions are written in JavaScript. Some embedded systems run it via Node. Oracle once shipped Nashorn, a JavaScript interpreter, as part of their Java Development Kit, beginning with JDK version 8 and removing it in JDK 15, replacing it with GraalJS. Over 80% of websites also rely on a third-party JavaScript library or framework for their client-side work. jQuery is the most-used of these, with Angular, React, Vue, Bootstrap, Lodash, Modernizr, and Underscore among the other prominent options.

• 6. The Trademark Nobody Expected

  ›

  The word "JavaScript" is a trademark of Oracle Corporation in the United States. It was not always Oracle's. Sun Microsystems received the trademark on the 6th of May 1997, when the ECMAScript specification was still fresh. Oracle acquired Sun in 2009 and inherited the trademark along with it. For years, the situation drew little attention. Then in September 2024, Ryan Dahl, the creator of Node.js, circulated a letter calling on Oracle to free the JavaScript trademark. More than 14,000 people signed it, including Brendan Eich, the man who originally wrote the language nearly three decades earlier. The initiative has not yet resulted in Oracle releasing the trademark, leaving the most widely used language on GitHub technically owned by a corporation that plays no role in its day-to-day governance. That governance runs through Ecma International's TC39 technical committee, with related web APIs maintained by W3C and WHATWG. The ECMAScript specification itself is now maintained openly on GitHub, with annual snapshots replacing numbered editions and individual proposals tracked through a public process.

• 7. Security and the Open Web

  ›

  Running code from strangers on millions of machines every day creates obvious risks. Browsers contain that risk through two main restrictions: scripts run in a sandbox limited to web-related actions, and the same-origin policy prevents scripts from one site reaching data from another. Most JavaScript security failures are breaches of one of those two lines. Cross-site scripting, known as XSS, lets an attacker inject malicious code into a trusted website, such as an online banking page, which then runs with the victim's own privileges. A study of 133,000 websites found that 37% included at least one library with a known vulnerability. The median gap between the oldest library version a site was using and the newest available version was 1,177 days. In March 2016, a developer named Azer Koculu removed his repository from npm, breaking tens of thousands of programs that depended on his libraries. Hardware-level attacks have also used JavaScript as a vector. In 2015, researchers demonstrated a JavaScript-based proof-of-concept of a rowhammer attack. In 2017, an attack called AnC used JavaScript in the browser to bypass address space layout randomization. The 2018 paper announcing the Spectre attacks on Intel processors included a JavaScript implementation of the exploit.