Firefox XPI Analyzer

Firefox XPI analyzer

Short answer

A Firefox XPI analyzer opens the ZIP-based add-on package produced by Firefox. It reads manifest.json, explains permissions and host access, and inspects JavaScript for static indicators. You can review an add-on without installing it or granting it access to your browser profile.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

XPI packages are ZIP archives

Firefox add-ons use the .xpi extension, but the container is a ZIP archive. Modern add-ons declare capabilities in manifest.json using browser extension APIs. Legacy add-ons used different structures and may not fully validate.

The analyzer handles root-level and nested manifests, reads text entries and skips binaries. It never loads the add-on into Firefox.

Related pages:Firefox XPI file analyzer

Firefox-specific signals

Firefox manifests may include browser_specific_settings with a Gecko ID and minimum version. Optional permissions and host permissions follow the same broad model as Chromium, but support varies by Firefox version.

The analyzer reports Firefox compatibility when it sees Gecko settings, background scripts or an XPI source. Declared permissions still describe the add-on's reach, regardless of the store label.

Manual analysis when store access is restricted

Automatic retrieval from addons.mozilla.org is attempted through its public API and approved hosts only. If retrieval fails, download the XPI from the add-on page and upload it here. No store access control is bypassed.

For high-value accounts, consider a separate browser profile for extensions you have not fully reviewed, and remove add-ons you no longer need.

Frequently asked questions

Can I inspect a Firefox add-on without installing it?

Yes. Upload the XPI or paste its addons.mozilla.org page URL. The package is parsed locally and the add-on is never installed.

Does the analyzer support legacy XPI add-ons?

It reads the ZIP and manifest when present. Legacy formats that do not use manifest.json may not produce a complete report.

Is every Firefox add-on reviewed by Mozilla?

Add-ons distributed through addons.mozilla.org go through a review process, but review is not a guarantee about privacy or future updates. Inspect the permissions yourself.

Why does automatic Firefox retrieval fail?

The API, network or store may block the request. When that happens, download the XPI manually and upload the file.

Last reviewed: October 31, 2026

Or analyze from a store URL