Extension External Domain Finder

Extension external domain finder

Short answer

An extension external domain finder extracts every URL and host pattern referenced in an extension's files. It groups domains by likely purpose so you can see whether an extension refers to analytics, advertising, authentication, error reporting or cloud services. A reference does not prove that a request was made.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Where domains come from

Domains are extracted from JavaScript string literals, HTML attributes, manifest host permissions, content-script matches, update URLs, CSP directives and web-accessible resources. They are counted and linked to the files where they appear.

The finder also reports wildcard host permissions as domains where possible. Patterns such as all_urls are handled separately as website access.

Categories are heuristics

Classification uses maintained hostname lists for well-known analytics, advertising, authentication, error reporting and cloud providers. Anything else is placed in the unknown category rather than being guessed.

A domain can serve multiple purposes. For example, a cloud storage host may deliver legitimate assets or receive collected data. Use the category as a starting point, then inspect the surrounding code and the publisher's documentation.

Domain categories used in the report
Category	Typical role	What to check
Analytics	Usage measurement	What events and identifiers are sent
Advertising	Ad delivery or attribution	Whether personal data is shared
Authentication	Sign-in and tokens	Which scopes and tokens are handled
Error reporting	Crash and exception data	Whether page content is included
Cloud services	APIs, assets, storage	Who controls the bucket or endpoint
Unknown	Unclassified	Read the surrounding code and publisher docs

Interpreting the list responsibly

A domain reference is a capability or a comment in code. It may be an unused constant, an optional feature, a documentation link or a URL in a bundled library. The report shows counts and files so you can distinguish a single mention from repeated use.

If a domain looks unexpected, search the source file, check the publisher's privacy policy and contact the developer. Avoid assuming data collection solely from the presence of an analytics hostname.

Frequently asked questions

Can this tool see what domains an extension actually calls?

No. It extracts static references from the package. Runtime monitoring is required to see real network activity.

Why is a domain listed that the extension never uses?

It may be an unused constant, a bundled library reference, an optional code path or a comment. The report links each domain to files and reference counts.

What does the unknown category mean?

The hostname is not in our maintained provider lists. It is not a suspicion score; it simply needs manual classification.

Can I export the domain list?

Yes. The JSON export contains every extracted domain, its category, reference count and source files.

Last reviewed: October 31, 2026

Or analyze from a store URL