CRX Package Analyzer

CRX package analyzer

Short answer

A CRX package analyzer opens the file format used by Chrome extensions, removes the signature header and reads the embedded ZIP archive. You can see the manifest, permissions, scripts and domains without installing anything. The analyzer never runs extension code, so suspicious JavaScript is inspected rather than executed.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What a CRX file contains

A CRX file is a ZIP archive with a header that carries the CRX version, a signed header and, in CRX2, a public key and signature. The extension itself is stored as ordinary ZIP entries: manifest.json, background or service-worker files, content scripts, HTML, images and other assets.

The analyzer validates the header boundaries and then treats the ZIP payload with the same limits as a normal upload. It never trusts file paths or declared sizes.

What the report shows

The report starts with the extension name, version, manifest version and browser compatibility. It then lists required and optional permissions, host access, content scripts, background configuration and content security policy.

A code section shows static findings with file, line, severity and confidence. A domain section groups every referenced host as analytics, advertising, authentication, error reporting, cloud or unknown.

Using a CRX analyzer safely

Only open files you obtained deliberately, either from a store or from a publisher you trust. Treat the analysis as one input: an unsigned or side-loaded CRX may keep changing outside the store review process.

If a store blocks automatic retrieval, download the package from the store page or ask the publisher for the build. Uploading the file gives you the same static report without bypassing store controls.

1
Choose the CRX file
Drag it onto the analyzer or select it from your device.
2
Wait for unpacking
The header is validated and ZIP limits are applied.
3
Review permissions first
Broad host access and powerful APIs define the extension's reach.
4
Check findings and domains
Use the evidence and file references to decide what to investigate.

Frequently asked questions

Can I open a CRX file without installing it?

Yes. This analyzer reads the CRX header and inspects the ZIP entries in your browser. Nothing is installed and no extension code is executed.

Does a verified CRX signature mean the extension is safe?

No. A signature ties the package to a key. It does not evaluate intent, data collection or the safety of the code.

Why does the analyzer ask me to upload a CRX?

Store URLs are supported where official retrieval works. When a store blocks automated downloads, you can download the package in your browser and upload the file.

Are large CRX files supported?

The upload limit is 25 MB. Archive entries and decompressed size are also capped to prevent excessive memory use and ZIP bombs.

Last reviewed: October 31, 2026

Or analyze from a store URL