Firefox XPI File Analyzer

Firefox XPI file analyzer

Short answer

A Firefox XPI file analyzer opens the ZIP-based add-on package and reads its manifest and scripts without installing it. You can review permissions, host access, content scripts, external domains and static code indicators. The add-on is never loaded into Firefox.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What is inside an XPI file?

An XPI is a ZIP archive that contains manifest.json plus the add-on's JavaScript, HTML, styles, images and locale files. Firefox reads the manifest to decide which capabilities to grant.

The analyzer validates archive paths and sizes, then inspects text entries. Binary assets and nested archives are skipped rather than opened.

Reviewing an add-on safely

Check host and content-script access first. Then review permissions such as cookies, history, tabs and webRequest, followed by code findings for dynamic code, remote scripts and data access.

If you obtain the XPI from addons.mozilla.org, use the public listing or the add-on's download link. The analyzer attempts official retrieval only when you provide an approved store URL.

Limitations of XPI inspection

The report shows static references and manifest declarations. It cannot observe runtime behavior, verify publisher identity or prove that data was collected. Legacy add-ons that do not use a standard manifest may produce incomplete results.

Frequently asked questions

How do I open an XPI file?

Upload it here or rename a copy to .zip and open it with an archive tool. The analyzer does this safely in your browser without installing the add-on.

Can I inspect a Firefox add-on from its store URL?

Yes, when the public API and approved hosts allow retrieval. If not, download the XPI and upload it manually.

Are XPI files safe to open?

They are archives, not executables. Opening one as an archive is generally safe. Do not install an add-on you have not reviewed.

Last reviewed: October 31, 2026

Or analyze from a store URL