Extension Data Collection Checker

Extension data collection checker

Short answer

An extension data collection checker looks for indicators such as analytics and advertising domains, broad host access, cookies or history permissions, credential and clipboard reads, and network endpoints in the code. These signals show where data could flow, not proof that data was collected or sold.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Indicators a static check can find

Data collection usually leaves traces in permissions, domains and code. A tracking SDK may appear as a known analytics domain. Credential access may appear as cookie or storage reads. Clipboard monitoring may appear as clipboard API calls or event listeners.

The report groups these indicators so you can review them together instead of treating each finding in isolation.

Analytics, advertising and session-replay domains
Cookies, history, tabs and webRequest permissions
Credential, token and clipboard access patterns
Broad host permissions and content-script matches
Unexplained endpoints in background code

What the indicators do not prove

A domain reference does not prove that the extension contacted it. A cookie permission does not prove that cookies were read or sent. Static analysis shows capability and code paths, not runtime behavior.

Legitimate features can also need sensitive access. A password manager needs credential access; a research tool may need history. The question is whether the access is proportionate and explained.

How to review the result

Start with the domains and permissions that are hardest to justify for the feature. Then read the code around the matching finding. Check the privacy policy for the same categories of data and retention period.

If the policy does not mention a category that the code can access, ask the publisher. If an update adds a new analytics or advertising domain, compare it with the previous version and read the release notes.

Frequently asked questions

Can an extension collect data without tracking permissions?

Yes. A content script with host access can read page content and send it to a server. Permissions define some capabilities, but code and domains matter too.

Does an analytics domain mean the extension sells my data?

No. It shows that analytics code or an endpoint is referenced. Whether data is sold depends on the publisher's policy and runtime behavior.

How can I reduce extension data collection?

Install fewer extensions, restrict site access, decline optional permissions, use a separate browser profile for sensitive accounts and remove unused add-ons.

Is clipboard access always a privacy risk?

Clipboard access can expose copied text, passwords or tokens. Some features need it, but it should be explained and limited to a user action.

Last reviewed: November 1, 2026