piapia123
en

Browser Extension Permission Checker

Web

Everything runs locally in your browser — nothing is uploaded

Input
Drop a file here to load its contents
Output

Paste a whole browser extension `manifest.json` and see what it can actually touch. The tool lists the name, version and manifest version (MV2 / MV3), translates each requested permission into what the extension can therefore do, and calls out high-risk items such as `<all_urls>`, `*://*/*`, `webRequest`, `cookies`, `clipboardRead` and `nativeMessaging`, ending with an overall risk grade. The reading is split by MV2 and MV3: MV3 puts site access in `host_permissions`, MV2 mixes it into `permissions` — without that split the most important warning is missed. If the JSON is broken, it points at the exact line and column. Everything runs in the browser.

Features

  • Lists the name, version and manifest version (MV2 / MV3)
  • Turns each permission into what the extension can do
  • Reads host permissions from the right place for MV2 and MV3
  • Warns separately about blanket access such as <all_urls> and *://*/*
  • Explains webRequest, declarativeNetRequest, cookies, clipboardRead, nativeMessaging and more
  • Gives an overall grade of OK, review, or high risk
  • On a JSON syntax error, shows the line, column and surrounding text
  • You can show permission names only, or switch the risk grading off
  • Copy any single line

How to use

  1. Paste the whole manifest.json into the box
  2. Choose whether to list the user-visible impact and whether to grade the risk
  3. The result appears at once: the manifest summary, each permission, host access and the verdict
  4. Use the copy button on a row to take just that item

FAQ

How do MV2 and MV3 permissions differ?
They live in different places. MV3 keeps API permissions in `permissions` and site access separately in `host_permissions`; MV2 mixes the two into `permissions`. So a MV3 extension with `"host_permissions": ["<all_urls>"]` would be missed entirely if it were read the MV2 way — and that is the one item that most deserves a warning. The tool branches on `manifest_version`.
Are activeTab and tabs not much the same?
Not at all. `activeTab` grants temporary access to the current tab only when you click the extension icon — the smallest possible reach. `tabs` allows reading and changing the URL and title of all your tabs at any time. The names look alike but the risk is different, so the tool labels them separately.
Is an extension with no permissions always safe?
Not necessarily, but fewer permissions certainly means less it can do. The tool judges only by what the manifest declares — it cannot see what the extension code actually does, nor permissions requested at runtime. So low risk means this manifest has no high-risk entries, not that the extension is trustworthy.
Is the manifest.json uploaded?
No. Parsing, translating and grading all happen in the browser, and the page makes no requests.

Related tools

Config Validator

Web

Check a package.json, .env, robots.txt, sitemap.xml or HTTP headers. Findings come in three levels — errors, warnings, suggestions — each with a reason.

JSON Formatter

Format

Format, validate and minify JSON in a collapsible tree with syntax highlighting and line numbers. Search, edit, delete or convert to Python dicts.

robots.txt Generator

Web

Generate a robots.txt: allow everything, block AI training crawlers, block everything or use a custom list, plus paths, Sitemap and Crawl-delay.

URL Parser

Web

Parse a URL into scheme, host, port, path, query parameters and fragment, with each parameter shown raw and decoded. Runs entirely in your browser.

User-Agent Parser

Web

Parse a user agent into browser, version, OS, device type and engine, and see which rules matched. Pattern matching only. Runs entirely in your browser.

HTTP Status Codes

Web

Look up an HTTP status code for its meaning, 1xx–5xx class, typical uses and common traps. Runs entirely in your browser.

← Back to all tools