Check a browser extension
A browser extension sees more than almost any app. With access to “all sites” it can read and change the pages you open — email, banking, personal accounts. Here you can see what an extension asks for — before installing it or afterwards.
The file is not uploaded to any server. The analysis runs entirely in your browser — the extension is never sent anywhere, we neither see nor store it.
How to check an extension — two steps:
- Get the extension file:
.crx(Chrome, Edge),.xpi(Firefox), or the folder of an installed extension compressed into a ZIP. - Drag it into the box below — or click “Choose extension file”.
Where to find the file of an installed extension
Open
chrome://extensionsand turn on “Developer mode” — each extension will show its ID.Find the folder with that ID on disk:
- Windows:
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\ID\version\ - macOS:
~/Library/Application Support/Google/Chrome/Default/Extensions/ID/version/ - Linux:
~/.config/google-chrome/Default/Extensions/ID/version/
For Edge the path is the same, with
Microsoft\Edgeinstead ofGoogle\Chrome.- Windows:
Compress the version folder into a ZIP, or simply choose its
manifest.json.
or drag it here — .crx, .xpi, .zip or manifest.json
The file stays in your browser — it is never sent anywhere, we neither see nor store it.
How to read the result
- Site access matters most. “All sites” means the extension can read and change any page you open.
- Permissions come from the manifest. They are what the extension can do, not what it actually does.
- “On request” — the permission is not granted at install: the extension may ask for it later.
- Extension ID comes from the
.crxsignature or the key in the manifest. You can use it to find the extension in the store.
Limitations
- We read the extension’s files but do not run it. Code may be obfuscated or loaded from a server after installation — a file analysis cannot see that.
- Addresses in the code are mentions, not proven data transfers. To see actual transfers you need to capture traffic — like the HAR check.