Shopify App Detection Dataset

The Detectify dataset contains 350 storefront signature rows mapped to 349 named tools and 348 unique case-insensitive patterns. It is published as JSON and CSV with a machine-readable summary and SHA-256 checksums for the August 13, 2026 snapshot.

How many signatures does Detectify check?

Detectify currently checks 350 public storefront signatures: 326 app signatures, 8 analytics signatures, 10 payment method signatures and 6 auxiliary storefront-tool signatures. These totals describe patterns Detectify can test for, not apps confirmed as installed on every scanned store.

Signature rows are not the same as unique apps. Carts Guru has two stored signatures, while Klarna intentionally appears as both an app and a payment method using the same public pattern. The detector collapses duplicate names within a result category.

Reproducibility snapshot

Dataset version

2026-08-13

Signature rows

350

Named tools

349

Unique normalized patterns

348

Matching rule

Case-insensitive exact substring

What is a Shopify app signature?

A signature is a stable text fragment associated with a tool, such as an asset hostname, script path, widget identifier or public service domain. Detectify looks for that fragment in the HTML returned by a public storefront. A match is evidence that the storefront exposes the tool; it is not access to the merchant's Shopify admin or private app list.

How does the matching process work?

1. Detectify requests the public storefront HTML through its server-side fetch endpoint.
2. It checks for Shopify-related storefront evidence before displaying app results.
3. The storefront HTML and each stored signature are normalized to lowercase.
4. Each signature is compared as an exact text fragment against the returned HTML.
5. Matches are grouped into apps, analytics tools and payment methods.

Case normalization prevents avoidable misses caused only by capitalization. Detectify does not treat a partial brand-name guess as proof unless that text is part of a stored signature.

What do the confidence labels mean?

Confidence describes the specificity of the matched storefront fragment, not the quality of an app. A signature containing a domain or path, or at least 12 characters, is labeled high confidence. Signatures of at least 8 characters are labeled medium confidence; shorter patterns are labeled low confidence.

Confidence is a practical interpretation aid. Even a high confidence match only proves that public evidence was present when the storefront was fetched.

Why can a real app still be missing?

Backend-only, admin-only, private and custom apps may leave no public trace. Shopify themes can also inline, rename, defer or proxy app assets. A no-match result therefore means Detectify found no current signature in the fetched storefront HTML; it does not prove that the merchant has no installed apps.

How should this dataset be cited?

The accurate description is: “Detectify matches publicly visible Shopify storefront signatures.” Avoid describing a match as direct access to a store's installed-app list. Use this page as the methodology URL and include the snapshot date when reporting exact signature totals.

How is a dataset change reviewed?

A new row needs a named tool, a public text pattern, a category, a destination URL and an image reference. Domain or asset-level clues are preferred over generic words. Before publication, the generator checks required fields, HTTPS destinations, local image references, category totals and derived-file integrity.

This validation proves that the published files are internally consistent; it does not prove that every third-party app still emits the same storefront code. Live signatures can change, which is why the snapshot date must accompany exact coverage claims.

What changed in the August 13 snapshot?

The dataset removed a Shopify Payments row that used the generic word shopify as its signature. That pattern could label nearly every Shopify storefront as using Shopify Payments, even when the payment method was not publicly confirmed. The current 350-row release favors a smaller, more precise dataset over an inflated coverage total.

Dataset integrity

SHA-256 for apps.json in this snapshot:

The full summary also publishes the CSV checksum, raw category counts and duplicate-name groups so automated consumers can confirm that files belong to the same release.

Download and inspect the data