About CRX Extractor
A tool for looking inside a Chrome extension, and a catalog of what extensions declare they can access.
What the tool does
A .crx file is a ZIP archive with a short signed header glued to the front. The header carries the signature and the publisher's public key; everything after it is an ordinary archive holding the manifest, the JavaScript, the styles and every other file the extension ships.
CRX Extractor reads that header, works out where it ends, and hands you back the rest as a .zip. That is the entire mechanism. It runs in your browser with no server involved, which is why the file you drop in is never uploaded anywhere and why the tool works just as well offline.
Why downloading a .crx is awkward
Google serves extension packages with the content type application/x-chrome-extension. When Chrome meets that type by following a link from another site it treats the file as an installation request rather than a download — and then refuses, because since 2018 Chrome only installs extensions that come from the Web Store itself. The download attribute that would normally force a save is ignored across origins, and the endpoint sends no CORS headers, so a page cannot fetch the bytes and hand them back either.
So this site keeps its own copy of the packages it catalogs and serves them as ordinary file attachments. That is the only arrangement in which the file actually lands in your downloads folder.
What the catalog records
Each extension page states what that extension declares in its own manifest: the permissions it requests, which sites it can read and change, the pages it injects code into, what its package contains, and the external hostnames that appear in its files. Alongside that sit the figures from its public Chrome Web Store listing — install count, rating, version, size and last update.
Every permission is described in plain language: what the capability reaches, and why an extension might legitimately want it.
What the catalog does not do
It does not score, rank or label extensions, and it never says an extension is unsafe. Reading a package tells you what an extension can do; it cannot tell you why the developer asked for a capability or what they do with it. A note-taking tool that reads every page you visit deserves a question; an ad blocker doing exactly the same thing is simply working. Publishing an automated verdict on thousands of named products would be both wrong and unfair to the many developers whose permissions are entirely reasonable.
So the pages give you the facts and the context, and leave the judgement where it belongs.
Where the data comes from
Extensions are discovered through the Chrome Web Store's own published sitemap, which lists roughly 350,000 of them and is refreshed daily. Metadata comes from each extension's public store listing. Everything technical — permissions, manifest version, file inventory, referenced hosts — is read out of the package itself.
Spanish and Japanese pages use the description the extension's own developer wrote in that language. Where a developer never supplied a translation, the store quietly returns the English text, and those pages are simply not created rather than filled with machine translation.
Privacy
Files you unpack are processed in your browser and never leave it. The site is static, has no accounts and stores nothing about you.
It does use Google AdSense, which sets its own cookies and is governed by Google's privacy policy rather than ours.
Who made it
Vladimir Ignatev. The tool has been online since 2016 and is open source under the GPL v3 — the code is on GitHub.