How to See What Permissions an Extension Has

How to see what permissions an extension has

Short answer

You can see permissions in the browser's extension details page, in the store listing summary, or precisely in the package's manifest.json. The manifest is the most complete source because it separates required, optional and host permissions that the browser UI may summarize.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Method 1: the browser's extension page

Open the browser's extension management page, select the extension and view its details. Chromium browsers show site access and some permission warnings. Firefox shows a permissions section in the add-on manager.

This is the fastest method for an installed extension. It reflects currently granted access, which can differ from what the package originally requested if the user restricted site access.

Method 2: the store listing

Store pages usually include a permissions summary or a link to the developer's disclosure. It is convenient but abbreviated. Broad categories can hide the exact site patterns and optional permissions.

Use the store summary as an overview, then inspect the package for detail.

Method 3: inspect manifest.json

Download the CRX, XPI or ZIP and upload it here. The analyzer locates manifest.json and explains permissions, host permissions and content scripts. This works before installation and shows optional access separately.

If you only have a store URL, try the built-in retrieval. When it is blocked, download the package and upload the file.

1
Get the package
Download it from the store or obtain it from the publisher.
2
Upload it
Drop the file into the analyzer.
3
Read the permission list
Check required, optional and host access.
4
Match to features
Investigate anything that lacks a clear purpose.

Frequently asked questions

Where is the permissions page in Chrome?

Open chrome://extensions, choose Details for the extension and review site access and permission warnings. Exact labels vary by Chrome version.

Can I see permissions before installing?

Yes. The store summary shows some, but the manifest in the package is the most complete source.

Why do browser warnings differ from the manifest?

Browsers group and humanize permissions. They may omit technical names or combine several capabilities into one warning.

Last reviewed: October 31, 2026