Extension analyzer
Inspect permissions, website access, domains and code indicators without installing or executing the extension.
Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.
What the scan checks
Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.
Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.
Compare two versions
See permission, domain and finding changes between two packages.
What the scan checks
Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.
Supported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.
Risk score breakdown
Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.