Extension Manifest Viewer

Extension manifest viewer

Short answer

An extension manifest viewer parses manifest.json and explains its fields without requiring the extension to be installed. It shows Manifest V2 or V3, required and optional permissions, host permissions, content scripts, background behavior, externally_connectable, web-accessible resources and content security policy.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

The manifest is the extension's public contract

manifest.json declares the extension's name, version, entry points and capabilities. Browsers read it before any extension code runs. If a permission is not declared, the extension generally cannot use the matching API without asking the user later.

Reading the manifest is usually faster and more reliable than guessing from the store description. The viewer highlights broad host access and powerful APIs such as debugger, nativeMessaging, proxy and cookies.

Fields the viewer explains

The viewer separates fields by purpose: identity, permissions, page access, background execution and communication. Nested fields are summarized instead of dumping raw JSON in your face.

Externally_connectable and web_accessible_resources are often overlooked. They describe which websites can message the extension or load its files. The viewer marks broad values so you can review them.

Manifest version and browser compatibility
Required and optional API permissions
Host permissions and content-script matches
Background service worker, scripts or page
Content Security Policy and update URL
Externally connectable origins and web-accessible resources

Manifest V2 and Manifest V3 side by side

Manifest V3 replaces persistent background pages with service workers, moves host permissions into a separate field and restricts remote code. Manifest V2 extensions still exist, especially outside the Chrome Web Store, but Chromium browsers have been phasing them out.

The viewer reports the manifest version and adds contextual notes instead of assuming that one version is automatically safer. Migration quality depends on how the publisher implements the new model.

Manifest versions at a glance
Area	Manifest V2	Manifest V3
Background	Page or scripts	Service worker or scripts
Host access	Often inside permissions	Separate host_permissions field
Remote code	Historically more permissive	Executable code must be bundled
Network rules	webRequestBlocking	declarativeNetRequest

Frequently asked questions

Can I view manifest.json without installing the extension?

Yes. Upload the CRX, XPI, ZIP or the manifest file itself. The viewer parses it in your browser and never installs anything.

What is the difference between permissions and host_permissions?

Permissions grant API access such as storage or tabs. host_permissions grant access to website URLs. Many extensions need both.

Why is a manifest field missing?

Different browsers and manifest versions use different fields. The viewer marks missing required values as warnings instead of inventing them.

Does the viewer validate the manifest schema?

It checks expected types and common fields, and reports schema issues. It is not an official browser validator and does not guarantee store acceptance.

Last reviewed: October 31, 2026

Or analyze from a store URL