Extension Permission Analyzer

Extension permission analyzer

Short answer

An extension permission analyzer reads the manifest and explains every declared API and website permission. It separates required access from optional requests, ranks capabilities by potential impact and shows the evidence behind the permission category score. It does not label an extension malicious for requesting powerful features.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Why permission analysis needs context

A permission name alone says little about risk. The tabs permission can reveal browsing activity, but many tab managers need it. Cookies can expose sessions, but a session manager may require it. The analyzer pairs each permission with a description and a recommendation.

It also reports optional permissions, which can expand access after installation, and host permissions, which define website reach.

How the permission category score works

Each known API permission has an impact weight. Required weights are summed and scaled, with a small additional weight for broad-access capabilities. Host permissions are scored separately under website access so the same reach is not counted twice.

The report shows the top weighted permissions and the aggregate. This is a transparent heuristic, not a vendor risk rating.

Using the result

Match each permission to a visible feature. If a capability is unnecessary for the product, prefer an alternative extension with narrower access. Review optional permissions before accepting a runtime prompt.

A permission analyzer informs a decision. It cannot show whether a permission was used or whether data left your browser.

Frequently asked questions

What does an extension permission analyzer do?

It parses the manifest, explains each permission and host pattern, and highlights high-impact capabilities. It never installs or executes the extension.

Does it analyze optional permissions?

Yes. Optional permissions are listed separately because they may be requested after installation.

Can every permission be explained?

Common browser permissions have curated explanations. Unknown permissions are marked for manual review against vendor documentation.

Last reviewed: October 31, 2026

Or analyze from a store URL