View Extension manifest.json Online

View extension manifest.json online

Short answer

You can view an extension manifest online by uploading a manifest.json file or the whole CRX, XPI or ZIP package. A viewer parses the JSON, validates common fields and explains permissions, host access, content scripts, background configuration and security settings in plain language.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What you can learn from manifest.json

The manifest names the extension, declares its version and entry points, and lists the permissions it needs. It is the first file a browser reads, which makes it the most reliable public description of capability.

A viewer groups related fields so you do not have to remember the schema. It highlights missing required values, deprecated manifest versions and broad permissions.

Name, version and description
Manifest version and browser signals
Required and optional permissions
Host permissions and content scripts
Background worker or scripts
CSP, update URL and externally connectable origins

Uploading only the manifest

A standalone manifest.json is accepted, but referenced scripts are not included. The report will show permissions and configuration without code findings for missing files.

For a complete analysis, upload the full CRX, XPI or ZIP. The analyzer locates manifest.json inside the package and scans the other text files.

Do not judge from one field

A manifest can look harmless while a referenced script performs sensitive work. Conversely, a broad permission can be justified by a feature. Read the manifest together with the code findings, domains and publisher information.

Frequently asked questions

Can I view manifest.json from a CRX file?

Yes. Upload the CRX and the analyzer opens the embedded archive and locates manifest.json automatically.

Is manifest.json valid JSON?

It should be, but real packages sometimes contain comments or malformed values. The viewer reports parse errors rather than failing silently.

Does the viewer show every manifest field?

It summarizes the fields that matter for privacy and permissions. The raw manifest is included in the JSON export for full inspection.

Last reviewed: October 31, 2026

Or analyze from a store URL