See what a Chrome extension actually does
Unpack its .crx package and read the source code, or look up
what it can reach in your browser before you install it. The unpacking happens in this
tab — the file is never uploaded anywhere.
Unpack a .crx you have
Drop the file in and get a .zip with the manifest and every
source file inside it.
Get the .crx for a Web Store extension
Paste the Chrome Web Store link, or just the extension id.
Look up an extension before you install it
The catalog records what each extension declares in its manifest: the permissions it asks for, the sites it can read and change, what its package contains and which external hosts appear in its code. Facts only — no scores, no verdicts.
Browse the catalog Read the FAQ
Why the permissions matter
An extension runs inside your browser with access you granted once and probably never reviewed. Some of them can read every page you open, including the ones where you are signed in. That is completely ordinary in an ad blocker or a password manager, and worth a second look in a wallpaper changer. The difference is not the permission — it is whether the permission fits what the extension is for.
Each capability has its own page explaining what it reaches and why an extension might legitimately want it:
How the unpacking works
A .crx file is a ZIP archive with a short signed header in front of it. The
header holds the signature and the public key; everything after it is the archive itself.
This page reads the header, works out where it ends, and hands you the rest as a
.zip. That is the whole trick, and it is why no server is needed and nothing
has to be uploaded.
The tool is open source under the GPL v3 — the code is on GitHub.