Firefox Add-on Privacy Checker

Firefox add-on privacy checker

Short answer

A Firefox add-on privacy checker inspects the XPI package's manifest, permissions, host access, content scripts, external domains and code indicators. It shows what the add-on can access and flags patterns that deserve review. It does not execute the add-on or prove that a permission was used.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What an XPI contains

An XPI is a ZIP archive with a manifest.json for WebExtensions, or a legacy install.rdf for older add-ons. The manifest lists permissions, content scripts, background scripts and browser-specific settings.

Modern Firefox add-ons use the same WebExtensions model as Chrome and Edge, with differences in API names, optional permissions and host-access prompts. Read the manifest before relying on the store summary.

Permissions and website access

Separate API permissions from host permissions. A permission such as cookies or history is different from access to all sites, and optional permissions are requested at runtime rather than granted at install.

Check content_scripts.matches and host_permissions together. A narrow add-on should not need every site unless its feature genuinely works across the web.

Required and optional API permissions
Host permissions and match patterns
Content scripts and run_at timing
Background scripts or event pages
External domains referenced in code

Firefox-specific review notes

Firefox shows some permissions in the add-on manager and may ask for host access separately. The package is still the most precise source because it shows the declared capabilities and the code that uses them.

Check the add-on's update URL, signature status and publisher. A signed XPI from addons.mozilla.org is not automatically private, but it gives you a review and distribution trail.

Frequently asked questions

How do I inspect a Firefox add-on before installing it?

Download the XPI, extract it and read manifest.json. Review permissions, host access, content scripts and code findings before loading the add-on.

Are Firefox add-ons safer than Chrome extensions?

Neither platform is automatically safer. Review and policy differ, but both can grant powerful access. The package and publisher matter more than the browser label.

Can I analyze a legacy XPI?

Some legacy add-ons use install.rdf rather than manifest.json. A modern analyzer may only support WebExtensions manifests, so check the supported formats first.

Does an add-on need all-sites access to work?

Only if its feature genuinely operates across every site. Many add-ons work with specific host patterns or activeTab access.

Last reviewed: November 1, 2026