CRX3 File Format Structure

CRX3 file format structure

Short answer

A CRX3 file starts with the magic bytes Cr24, a little-endian version value of 3, a 32-bit header length and a signed header, followed by a standard ZIP archive. The ZIP holds the extension files. Parsers must validate the header length before extracting anything.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Byte layout

Bytes 0-3 contain the ASCII string Cr24. Bytes 4-7 contain the version as a little-endian unsigned 32-bit integer. Bytes 8-11 contain the header length. The header begins at byte 12 and occupies the declared length. The ZIP begins immediately after it.

CRX3 does not use the older separate public-key and signature length fields from CRX2. Its header carries signed data, and the ZIP signature should appear where the length calculation says it will.

CRX3 header fields
Offset	Size	Meaning
0	4 bytes	Magic: Cr24
4	4 bytes	Version: 3
8	4 bytes	Header length (little-endian)
12	N bytes	Signed CRX header
12 + N	Remaining	ZIP archive payload

Safety checks before extraction

A parser should reject truncated files, header lengths larger than the remaining buffer, and payloads that do not begin with a ZIP signature. It should also apply archive limits after locating the ZIP.

The analyzer performs these checks in sequence and never interprets the CRX header as executable code. If the structure is invalid, the scan stops with a clear error instead of guessing.

Signature versus safety

The signed header helps browsers associate the package with an extension identity and detect some tampering. It does not audit the JavaScript, permissions or data practices. A valid signature can sign a privacy-invasive extension.

Frequently asked questions

Is CRX3 the same as ZIP?

No. CRX3 is a ZIP payload with an additional CRX header. The embedded archive is standard ZIP after the header is removed.

Why is the header length little-endian?

The CRX format stores the version and header length as little-endian 32-bit integers, matching the platform conventions used by the format's tooling.

Can I extract a CRX3 file with unzip?

Not directly, because of the header. Remove the header using a CRX-aware tool or use this analyzer.

Last reviewed: October 31, 2026

Or analyze from a store URL