What is a web app manifest?

It is a JSON file, linked from your HTML with , that tells the browser how your site should behave when installed to a home screen: what name to show under the icon, which icons to use, which URL to open, and whether to run inside a browser frame or in its own window. Without it the browser has nothing to install and no install prompt appears.

What does a manifest need to be installable?

Four fields do the work: a name or short_name for the label under the icon, a start_url for what opens on launch, a display value of standalone, fullscreen or minimal-ui so it does not just open a browser tab, and at least one icon of 192 pixels or larger. Browsers additionally require the site to be served over HTTPS and, in Chromium, to register a service worker with a fetch handler. A manifest that satisfies its own four fields is necessary but not sufficient.

Where should the manifest file live?

Anywhere you like, because the browser follows the href in your . Do not assume /manifest.json: real sites name it manifest.webmanifest, put it behind a CDN, or fingerprint the filename for cache busting. Spotify serves its manifest from open.spotifycdn.com under a hashed name. Any tool that probes /manifest.json directly will report a false negative on sites like that.

How many major sites ship a valid manifest?

In a measurement of 40 major sites on 2026-08-24, ten met all four install criteria, nineteen had no in their served HTML at all, three had a manifest with fields missing, one served a manifest URL whose content would not parse as JSON, and seven refused the probe outright with a 403, a 400 or a network failure. Those seven were recorded separately, because a refusal is not an absence.

Why does display matter so much?

Because it is the difference between an installed app and a bookmark. With display set to browser, or absent entirely, the launcher opens your site inside the normal browser chrome with an address bar, which is what a shortcut already did. Setting standalone gives the site its own window with no browser UI, which is the whole reason a user installed it. Airbnb was the one site in this measurement whose manifest was otherwise complete but had no usable display value.

Web app manifest: I checked 40 major sites, 10 are actually installable

A web app manifest is a small JSON file that turns a website into something a phone can install. It is the difference between a bookmark and an icon on the home screen that opens in its own window.

The spec is short and the implementation is a single file. So how many large sites actually get it right? On 2026-08-24 I measured 40 well known domains. The raw data, the method and the limits are published openly with a DOI: 10.5281/zenodo.22084209.

The result

installable            10   manifest present, all four criteria met
no manifest link       19   no <link rel="manifest"> in the served HTML
probe refused           7   403, 400, or network failure
incomplete              3   manifest present, criteria missing
unparsable              1   manifest URL present, content not JSON

The three incomplete ones are instructive because each fails differently:

airbnb.com     missing display
figma.com      missing start_url
linkedin.com   missing start_url, display, and any icon >= 192px

Read the link, never guess the path

The single most important thing this measurement does is find the manifest the way a browser does: parse the served HTML, take the href from <link rel="manifest">, and resolve it against the final URL after redirects.

Probing /manifest.json directly would have been faster and wrong. Spotify serves its manifest from open.spotifycdn.com under a fingerprinted filename. A tool that guesses the path reports Spotify as having no manifest, which is a false negative produced entirely by the tool.

Seven refusals are not seven absences

Seven of the forty domains would not answer my probe: 403 from ebay, etsy, medium and stackoverflow, 400 from facebook after redirects, a truncated read from netflix, a network failure from starbucks.

They are recorded as probe refused, not as no manifest. Those are different facts, and only one of them is about the site.

This is not a theoretical scruple, and the first pass of this very measurement proves it. That pass did not follow redirects on the homepage, and it reported nine inaccessible domains. Following redirects turned two of them into real results: uber.com genuinely has no manifest link, and flipkart.com is fully installable. Two of nine "inaccessible" sites were an artefact of my own probe.

Any survey that folds refusals into a single "not supported" bucket is mixing what it measured with what it could not measure, and the second number will always be larger than the author thinks.

What a minimal working manifest looks like

{
  "name": "Your Site",
  "short_name": "Site",
  "start_url": "/?source=pwa",
  "display": "standalone",
  "background_color": "#ffffff",
  "theme_color": "#111111",
  "icons": [
    { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png" },
    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png" },
    { "src": "/icon-maskable.png", "sizes": "512x512", "type": "image/png",
      "purpose": "maskable" }
  ]
}

Link it from every page you want installable:

<link rel="manifest" href="/manifest.webmanifest">

Three notes worth more than the file itself:

start_url with a query parameter lets your analytics separate installed launches from ordinary visits. It costs nothing and it is the only reliable way to know whether anyone installs your site.
A maskable icon stops Android from putting your square logo inside a white circle. Without "purpose": "maskable" the launcher pads whatever you gave it, and the result usually looks like a mistake.
display: standalone is the point. Leave it out, as Airbnb does, and the installed icon opens a browser tab with an address bar. The user did the work of installing and got a bookmark.

Valid is not the same as installable

Everything above is about the manifest satisfying its own criteria. A browser asks for more: the site must be served over HTTPS, and Chromium wants a registered service worker with a fetch handler before it offers an install prompt.

So installable in the table means the manifest is complete, not that Chrome will show the banner. That distinction is in the dataset README too, because a survey that quietly conflates the two would overstate its own result.

Check your own in one minute

Open your site, view source, find <link rel="manifest">. If it is not there, nothing else matters.
Open the href it points at. It must return JSON, not an HTML error page dressed as a success.
Check the four fields: a name, a start_url, a display of standalone, and an icon of 192px or more.
In Chrome DevTools, Application then Manifest, which lists what is missing rather than making you diff the spec.

One measurement, one vantage point, one date. If a site has fixed theirs since, the dataset carries its date and rerunning it takes minutes.