Criteria that matter
A useful checker must go beyond the store summary. It should parse manifest.json, separate required, optional and host permissions, and reveal content-script patterns. It should also state its limits clearly.
Privacy of the checker itself matters. Prefer local processing, no account requirement and a clear statement that uploaded code is never executed.
| Criterion | Why it matters |
|---|---|
| Formats | CRX, XPI, ZIP and manifest support |
| Host analysis | Shows which sites can be accessed |
| Code evidence | File and line references for findings |
| Domain extraction | Reveals potential endpoints |
| Transparency | Explains scoring and states limits |
| Local processing | Keeps the package on your device |
| Exports | JSON and PDF for records |
Related pages:extension permission analyzeradd-on permission scanner
What this tool does differently
This analyzer processes packages in a Web Worker, never executes extension code, and reports required and optional permissions with host access separately. It adds static code findings, domain classification and a transparent six-category score with evidence.
It supports Chrome CRX, Firefox XPI, ZIP packages and standalone manifests, with optional PDF and JSON exports. It does not claim to prove malicious behavior.
Related pages:browser extension privacy checkerhow to audit an extension
No ranking guarantees
Tool quality changes, and search rankings are not a safety evaluation. Test a checker with a package you understand and see whether its findings are accurate, specific and honest about uncertainty.