Extension Privacy Checker
Free, private, static analysis

Know what a browser extension can see before you install it

Upload a CRX, XPI, ZIP or manifest.json file. Get a plain-language report on permissions, website access, external domains, code indicators and risk. The extension is never executed.

Files are processed in your browserUploaded code is never executedNo account, no tracking, free to use
Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

Or analyze from a store URL

Manual upload is always available and avoids store access limits.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Supported packages

One file, up to 25 MB. Archive safety limits protect the analyzer from ZIP bombs and unsafe paths.

CRX, XPI, ZIP and manifest.json

Chrome CRX

.crx

Firefox XPI

.xpi

ZIP package

.zip

manifest.json

manifest.json

How the analysis works

Every result comes from the package contents. Nothing is installed or run.

  1. 1

    Upload the package

    Drop a CRX, XPI, ZIP or manifest file, or paste a Chrome, Edge or Firefox store URL.

  2. 2

    Safe unpacking

    The archive is validated in an isolated worker. Path traversal, oversized entries and nested archives are blocked or skipped.

  3. 3

    Static inspection

    Manifest fields, permissions, JavaScript patterns and referenced domains are collected without executing any code.

  4. 4

    Transparent report

    You see the evidence behind every finding and exactly how the six-part risk score was calculated.

What you get in the report

Built for nontechnical users, with evidence for anyone who wants to verify the result.

Permission explanations

Required and optional permissions, host permissions and content-script access explained in plain language.

Code indicators

Dynamic code execution, remote script loading, obfuscation signals, storage, messaging and DOM injection patterns.

External domains

Referenced hosts grouped as analytics, advertising, authentication, error reporting, cloud services or unknown.

Evidence-based score

A transparent 0-100 score with category weights, evidence and an explicit reminder that a score is not a malware verdict.

Learn before you install

Original guides about permissions, manifests, content scripts and privacy risk.

View all topics

The interface is translated into 12 languages. Long-form guides are currently maintained in English and marked as English-only where no reviewed translation exists.

Common questions

Does the analyzer execute the extension?

No. Files are parsed as data in a Web Worker. JavaScript is read by a static parser, never sent to eval, imported or installed in the browser.

Are my uploaded files stored?

No. Analysis happens in your browser and the report exists only in the page. Nothing is uploaded to our servers, so there is no server-side copy to delete.

Can a high risk score prove that an extension is malware?

No. The score estimates exposure from permissions and static code references. Legitimate tools can request broad access, and a low score cannot guarantee safety.

Which browsers are supported?

Chrome and other Chromium browsers (CRX and ZIP), Microsoft Edge (CRX), and Firefox add-ons (XPI). A standalone manifest.json is also accepted.

Is the tool free?

Yes. The analyzer, reports and exports are free. There is no account requirement and no paywall around the scan.

Check an extension now

Static analysis takes seconds and works on desktop and mobile.

Start a free scan