What can you inspect in a CRX file for free?

You can inspect every text entry that matters for a privacy review: manifest.json, background and service-worker scripts, content scripts, popup HTML and JSON configuration. The analyzer summarizes the manifest instead of dumping raw JSON, and it lists each permission with a plain-language explanation.

The report also extracts external domains and groups them by likely purpose. Code findings include file names and line numbers where available, so you can verify the evidence yourself.

Related pages:unpack a CRX without installingCRX3 structure

How to analyze a CRX file in three steps

Download the CRX from the store or obtain it from the publisher. Open this page, drop the file onto the analyzer and wait for unpacking. Review permissions and host access first, then read the code findings and domain list.

Everything happens locally in a Web Worker. The file is not uploaded to a server, and the extension code is parsed as text rather than executed.

  1. 1

    Get the package

    Download the CRX or use a supported store URL.

  2. 2

    Upload it

    Drop the file or choose it from your device.

  3. 3

    Read the report

    Start with permissions, then evidence and domains.

Related pages:CRX package analyzerbrowser extension privacy checker

What the free analysis cannot do

It cannot execute the extension, so it cannot observe runtime network traffic, permission use or behavior that depends on a logged-in account. It also cannot follow code that is fetched after installation.

A CRX signature and a clean static report are not safety guarantees. Use the report to make an informed decision, not as a certification.