Article
CRX file analyzer online free
Analyze a CRX file online for free. See the manifest, permissions, host access, scripts, external domains and a transparent risk score without installing it.
Read the full explanationLearn
View all topicsLearn
Focused answers to the questions people ask before installing a browser extension.
Guide
How to check Chrome extension permissions before installing
Learn how to check Chrome extension permissions before installing. Read the manifest, separate API and host access, and identify broad permissions.
Read the full explanationArticle
Firefox XPI file analyzer
Analyze a Firefox XPI file online. Inspect manifest permissions, host access, background scripts, content scripts, domains and code findings.
Read the full explanationArticle
Manifest V3 permissions list explained
A plain-language list of common Manifest V3 permissions, including host permissions, cookies, tabs, scripting, webRequest, debugger and storage.
Read the full explanationArticle
What does the <all_urls> permission mean?
Understand the <all_urls> extension permission: which websites it covers, what it allows, how it differs from an API permission and what to check.
Read the full explanationArticle
Chrome extension host permissions checker
Check Chrome extension host permissions and content-script match patterns. See which websites an extension can access and how broad the patterns are.
Read the full explanationArticle
View extension manifest.json online
Open an extension manifest.json online and read its permissions, host access, content scripts, background configuration and security fields.
Read the full explanationGuide
Unpack a CRX file without installing it
Learn how to unpack a CRX file without installing the Chrome extension. Understand the CRX header, ZIP payload and safe inspection methods.
Read the full explanationArticle
Check what domains a Chrome extension connects to
Find the domains referenced by a Chrome extension. Learn how static domain extraction works, what the groups mean and why a reference is not proof of traffic.
Read the full explanationArticle
Extension externally_connectable explained
Learn what externally_connectable does in a browser extension, which websites can message it, and why broad origins deserve review.
Read the full explanationArticle
Is this Chrome extension safe to install?
A practical checklist for deciding whether a Chrome extension is safe to install: permissions, publisher, code evidence, domains and update behavior.
Read the full explanationArticle
Chrome extension service worker vs background page
Compare a Manifest V3 service worker with a Manifest V2 background page: lifecycle, persistence, network access, privacy implications and what to inspect.
Read the full explanationArticle
Content script match patterns explained
Learn how extension content-script match patterns work, including scheme, host, path, wildcards, all_urls, run_at and all_frames.
Read the full explanationArticle
Extension web_accessible_resources security
Understand web_accessible_resources in browser extensions: which files websites can load, how matches limit exposure and what broad patterns risk.
Read the full explanationArticle
CRX3 file format structure
Understand the CRX3 file format: magic bytes, version, little-endian header length, signed protobuf header, ZIP payload and safety checks.
Read the full explanationArticle
Extension CSP in Manifest V3 explained
Learn how Content Security Policy works in Manifest V3 extensions, what extension_pages and sandbox mean, and why unsafe-eval matters.
Read the full explanationArticle
Extension permission analyzer
Analyze extension permissions with plain-language explanations. Separate required, optional and host access, and identify high-impact capabilities.
Read the full explanationArticle
Chrome extension inspector online
Inspect a Chrome extension online. Review manifest fields, permissions, host access, content scripts, source indicators and external domains.
Read the full explanationArticle
Add-on permission scanner
Scan browser add-on permissions for Chrome, Edge and Firefox. See required, optional and host permissions with impact ratings and recommendations.
Read the full explanationArticle
Browser plugin source analyzer
Analyze browser extension source code without running it. Find dynamic code, remote scripts, obfuscation, DOM injection, storage and messaging patterns.
Read the full explanationArticle
Extension website access inspector
Inspect which websites an extension can access. See host permissions, content-script match patterns, wildcards, all_urls and frame behavior.
Read the full explanationArticle
Browser add-on data access checker
Check what data a browser add-on can access: cookies, tabs, history, storage, page content and external domains. Understand capability versus behavior.
Read the full explanationArticle
Extension JavaScript behavior analyzer
Analyze extension JavaScript for dynamic code, remote scripts, DOM injection, storage, cookies, messaging and obfuscation indicators.
Read the full explanationArticle
Are Chrome extensions safe?
Are Chrome extensions safe? Learn the real risks, how store review works, which permissions matter and how to inspect an extension before installing.
Read the full explanationGuide
How to see what permissions an extension has
See an extension's permissions from the browser UI, its store listing or its manifest.json. Compare required, optional and website access.
Read the full explanationArticle
Chrome extension reading all sites permission
What does it mean when a Chrome extension can read all sites? Learn how all_urls works, what data it can reach and how to limit exposure.
Read the full explanationArticle
Does this extension track me?
Learn how to tell whether an extension might track you. Review analytics domains, cookies, identifiers, permissions, storage and runtime testing.
Read the full explanationArticle
Extension asking for cookies permission
Understand the extension cookies permission: what it allows, why session cookies are sensitive, legitimate uses and what to check before installing.
Read the full explanationArticle
Manifest V2 vs V3 security differences
Compare Manifest V2 and V3 security: background execution, host permissions, remote code, CSP, network rules and what still requires review.
Read the full explanationGuide
How to audit an extension before install
A step-by-step extension audit before installation: publisher checks, manifest review, permissions, code findings, domains and risk decisions.
Read the full explanationArticle
Best extension permission checker tools
Compare extension permission checker tools by accuracy, privacy, supported formats, explanations, evidence, exports and limits. No ranking guarantees.
Read the full explanationGuide
How to compare Chrome extension versions
Compare two Chrome extension versions to see permission, host pattern, domain and code finding changes. Learn which update changes deserve a closer review.
Read the full explanationGuide
Chrome extension safety check
Run a Chrome extension safety check on permissions, host access, content scripts, code indicators and external domains. Learn what it can and cannot prove.
Read the full explanationArticle
Extension risk score explained
Understand how an extension risk score is calculated, what the six categories measure, how to read the bands and why the score is not a malware verdict.
Read the full explanationGuide
How to check Chrome extension source code
Learn how to obtain, unpack and review Chrome extension source code for permissions, entry points, remote scripts, obfuscation and suspicious patterns.
Read the full explanationArticle
Firefox add-on privacy checker
Inspect a Firefox add-on XPI for permissions, host access, content scripts, external domains and code indicators before installing it.
Read the full explanationArticle
Edge extension permission checker
Check a Microsoft Edge add-on's permissions, host access, content scripts, external domains and code indicators before installing or updating it.
Read the full explanationArticle
Extension data collection checker
Check an extension for data-collection indicators such as analytics domains, tracking permissions, credential access and clipboard reads.
Read the full explanationArticle
Browser extension malware scanner
What a browser extension malware scanner can detect statically, why it cannot prove malware, and how to combine indicators with runtime checks.
Read the full explanationArticle
Tabs vs activeTab permission difference
The tabs permission watches every tab continuously; activeTab grants temporary access to the current tab after a click. Compare scope, trigger and risk.
Read the full explanationArticle
Native messaging permission explained
The nativeMessaging permission lets an extension talk to a native desktop application. Learn how it works, what it enables and what to verify before trusting it.
Read the full explanationGuide
Chrome extension site access: on click explained
Chrome's runtime site access setting controls where extension code runs. Learn what On click, On specific sites and On all sites actually change.
Read the full explanationGuide
How to audit installed Chrome extensions
A practical audit of the extensions already running in your browser: review manifests, host access, code indicators and remove what no longer earns its runtime cost.
Read the full explanationArticle
Chrome Web Store privacy practices tab explained
What each section of the Chrome Web Store privacy practices tab means, how the disclosures relate to declared data types, and their limits.
Read the full explanationArticle
Safari web extension privacy check
Run a Safari web extension privacy check on the WebExtension manifest inside the app bundle: permissions, host access, content scripts and code indicators.
Read the full explanation