JSP File Documentation

Summary

A JSP (Jakarta Server Pages, formerly JavaServer Pages) file is server-side source for a dynamic web page: HTML markup with embedded Java that runs on a Java web server such as Apache Tomcat. The server compiles it into a servlet, runs it, and sends your browser plain HTML, so its response MIME type is text/html. Introduced in 1999 and now maintained under Jakarta EE, a .jsp is plain text and is not a file you are meant to download and open.

Technical details

Feature	Value
Full name	Jakarta Server Pages (formerly JavaServer Pages)
File extension	`.jsp` (also `.jspx`, `.jspf`)
Response MIME type	`text/html`
Format type	Server-side Java web page source (plain text)
Developer	Sun Microsystems (1999); now Eclipse Foundation (Jakarta EE)
Introduced	1999 (JavaServer Pages 1.0)
Renamed	Jakarta Server Pages under Jakarta EE (2019)
Standard	Jakarta Server Pages specification
Open standard	Yes
Encoding	Plain text (UTF-8 / declared page encoding)
Magic number	None (text; often opens with `<%@ page ... %>`)
Runs on	Apache Tomcat, Jetty, WildFly and other servlet containers
Compiled to	A Java servlet (`.java` then `.class`) by the JSP engine
Tomcat engine	Jasper (generates e.g. `login_jsp.java`)
Comparable to	PHP, ASP/ASPX (server-side page technologies)
Related extensions	`.java`, `.html`, `.jspx`, `.war`, `.asp`
Specification	`jakarta.ee/specifications/pages/`

Syntax at a glance

A .jsp is plain text with no binary signature. It is HTML with embedded Java in special tags: a directive <%@ page ... %> configures the page (and often appears on the first line); a scriptlet <% ... %> runs Java statements; an expression <%= ... %> writes a value into the output; and Expression Language ${...} with JSTL tags provides logic without raw Java. The server evaluates all of these and sends the browser only the resulting HTML — the browser never sees the tags.

What is a JSP file?

JSP stands for Jakarta Server Pages, originally JavaServer Pages, a Java technology for building dynamic web pages. It was introduced by Sun Microsystems in 1999 and is now maintained by the Eclipse Foundation as part of Jakarta EE, which is why the name changed in 2019. A .jsp file is server-side source code: HTML markup with pieces of Java embedded in special tags. Conceptually it is the Java counterpart of PHP or Microsoft’s ASP/ASPX: a template that a server turns into a finished HTML page.

The key thing to grasp is where a JSP runs. A .jsp lives on a Java application server such as Apache Tomcat, Jetty or WildFly. When a browser requests a page like login.jsp, the server executes the page’s Java, assembles HTML, and sends only that HTML back. The browser never receives the .jsp file itself, which is why .jsp so often appears in the URLs of older corporate, banking and government sites even though you can never download the actual source. It is plain text, so it opens in any editor, but on its own it does nothing without a server to run it.

JSP syntax: directives, scriptlets, expressions and EL

A JSP is HTML with four kinds of embedded Java construct, each in its own tag delimiters. Together they let the static layout and the dynamic logic sit in one file.

<%@ page contentType="text/html" import="java.util.*" %>   directive
<html><body>
  <% String user = request.getParameter("name"); %>         scriptlet (statements)
  <h1>Hello, <%= user %></h1>                                expression (writes output)
  <p>Today is ${java.time.LocalDate.now()}</p>               EL (Expression Language)
</body></html>

A directive <%@ ... %> configures the page as a whole: its language, imports, content type and error page. It usually appears at the top, which is why many JSP files begin with a <%@ page ... %> line. A scriptlet <% ... %> holds Java statements that run when the page is served. An expression <%= ... %> evaluates a Java expression and writes its string value into the output. Finally, Expression Language ${...} together with JSTL tag libraries expresses logic (loops, conditionals, property access) without raw Java, which is the style modern JSP favours because it keeps Java code out of the page.

How the server turns a JSP into a servlet

A JSP is never interpreted line by line at each request. Instead the server compiles it, once, into a Java servlet. On Apache Tomcat this is done by the Jasper engine: the first time login.jsp is requested, Jasper translates it into a Java source file (something like login_jsp.java), compiles that to a .class, loads it, and from then on runs the compiled servlet directly. Subsequent requests skip translation and just execute the class, which is why only the first hit after an edit is slow.

login.jsp  --(Jasper translate)-->  login_jsp.java  --(javac)-->  login_jsp.class
                                                                     |
request  --------------------------------------------------->  execute servlet  --> HTML

The translation maps each JSP construct to Java: template HTML becomes calls that write literal text to the response, scriptlet code is copied into the servlet’s service method, and an expression becomes a write of its value. Understanding this pipeline explains several things at once: why a syntax error in a JSP surfaces as a Java compilation error, why implicit objects like request, response, session and out are available without being declared (Jasper injects them into the generated method), and why the generated .java can be found under Tomcat’s work directory but should never be edited by hand.

Why a website sometimes downloads a .jsp instead of your file

For non-developers, the most common encounter with a .jsp is unwanted: you clicked a “Download” or “Print” link and the browser saved a file named something like report.jsp instead of the PDF, image or spreadsheet you expected. This happens when the server generates the document through a JSP handler but sends the wrong Content-Type header or the wrong filename. The downloaded file is usually the real document with the wrong extension. Renaming report.jsp to report.pdf (or .jpg, .xlsx) and opening it normally typically works. If it will not open after renaming, the page produced the file only when run on the server, and the fix is to use the site’s proper download link or “Save link as” rather than any offline converter, because a genuine .jsp is a program, not a printable document.

Server-side security: JSP web shells

The .jsp extension says nothing about safety to someone merely viewing a page in a browser: in a URL it is just a normal web page, and a downloaded .jsp opened in a text editor cannot run anything. The real security concern is on the server, and it is a serious one. Because a JSP is code that the server compiles and executes, an attacker who can write a .jsp file into a web-accessible directory gains arbitrary code execution on the server. Such a file is called a web shell.

The mechanism is direct. A JSP scriptlet can call into the full Java runtime, so a one-line file such as <% Runtime.getRuntime().exec(request.getParameter("cmd")); %> will run whatever operating-system command an attacker passes in the URL, executing with the privileges of the servlet container. Attackers plant these through file-upload features that fail to restrict type or destination, through path-traversal flaws that let an upload land inside the web root, or through vulnerabilities that allow writing to the application’s deployed folder. The defences are correspondingly server-side: never let user-uploaded files be written into a directory the container will execute, store uploads outside the web root, disable JSP execution in upload folders, and run the container as a low-privilege account so a compromised page cannot reach the wider system. For an ordinary visitor, none of this is a risk from the page itself; it is a concern for whoever operates the server.

Editing JSP source and where it fits

Developers edit .jsp source in a code editor or IDE, because it is plain text: Visual Studio Code, IntelliJ IDEA and Eclipse all handle it, with IntelliJ and Eclipse adding JSP-aware tooling and a way to run the page on a configured Tomcat. The Java Development Kit is the runtime that ultimately executes the compiled servlet; it is not an application you “open” a JSP with. JSP is mature, largely legacy technology: newer Java web stacks favour Spring MVC with Thymeleaf, JSF/Facelets, or a JavaScript front-end calling REST APIs, so .jsp is mostly seen on established applications rather than new ones.

Frequently asked questions

Why did a website download a .jsp file instead of a PDF?

The server generated your document through a JSP page but labelled the response with the wrong file type or name. The download is usually the real PDF with the wrong extension, so renaming it from .jsp to .pdf and opening it normally often works. If that fails, use the site’s proper download link, since a real .jsp is server code with nothing to convert offline.

What does .jsp at the end of a web address mean?

It means the page is built with Jakarta/JavaServer Pages and runs on a Java web server such as Apache Tomcat. It is part of the URL, not a file you download: the server runs the page and returns plain HTML to your browser. You cannot retrieve the underlying .jsp source over the web.

What is the difference between JSP and PHP or ASPX?

All three are server-side page technologies that generate HTML. JSP uses Java and runs on servers like Tomcat, PHP uses the PHP language, and ASPX uses Microsoft’s ASP.NET. To the browser they are identical, because each one returns only the HTML it produced, never its own source.

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.

Table of contents