Unpack a CRX File Without Installing

Unpack a CRX file without installing it

Short answer

A CRX file is a ZIP archive with a small CRX header. To unpack it safely, remove the header and extract the ZIP with an archive tool, or upload the CRX to a static analyzer that performs the same steps in an isolated worker. You never need to install the extension.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Understand the header before extracting

CRX2 and CRX3 use different headers. CRX3 stores a little-endian header length after the magic bytes and version, followed by a signed header and then the ZIP. CRX2 stores public-key and signature lengths. Cutting at the wrong offset produces a corrupt archive.

The analyzer validates these boundaries and checks that the remaining bytes begin with a ZIP signature. It also enforces entry and size limits before decompressing.

Related pages:CRX3 structure CRX package analyzer

Two safe ways to inspect the contents

The simplest method is to upload the CRX to this analyzer. It shows the manifest and findings in a readable report without installing anything. No command line or extension developer mode is required.

If you prefer local tools, use a script or archive utility that understands the CRX header, then inspect the extracted files with a text editor. Treat the extracted JavaScript as untrusted text and do not open HTML files in a browser with the extension's scripts.

1
Obtain the CRX
Download it from the store or get it from the publisher.
2
Strip the header
Parse the version-specific header and locate the ZIP signature.
3
Extract the ZIP
Use an isolated folder and avoid executing any extracted code.
4
Inspect manifest and code
Read permissions, scripts and domains, or use the analyzer report.

Safety rules for unpacking

Never run an extracted script to see what it does. Do not load the unpacked folder as an extension in developer mode unless you accept the risk. Keep archive extraction inside a dedicated folder and avoid opening files that could trigger a local handler.

If the package contains nested archives, the analyzer skips them. You should be equally cautious: nested content is not part of the reviewed manifest and can hide additional files.

Frequently asked questions

Can a CRX file be renamed to ZIP?

Not directly. The CRX header must be removed first. Renaming alone leaves extra bytes before the ZIP and standard tools may fail.

Does unpacking a CRX install the extension?

No. Unpacking only extracts files. Installation happens only if you load the folder or package into a browser as an extension.

Is it legal to unpack a CRX?

Inspecting a package you obtained lawfully is generally acceptable, but the extension's license may restrict redistribution or reverse engineering. Follow applicable law and the license.

Last reviewed: October 31, 2026