Chrome extensions, .crx files and permissions — FAQ
Common questions about extension packages, their source code and what the permissions they declare actually mean.
What is a .crx file?
A .crx file is the packaged form of a Chrome extension. It is a ZIP archive with a short signed header in front of it, holding the manifest, the JavaScript, the styles and every other asset the extension ships.
Why does Chrome try to install a .crx instead of downloading it?
Because of the content type. Google serves packages as application/x-chrome-extension, and Chrome treats that as an install request rather than a file. Since 2018 it also refuses installs that did not come from the Web Store, so the attempt fails. Downloading it from this site works because we serve the same bytes as an ordinary attachment.
Can I read an extension's source code without installing it?
Yes. Download the .crx and drop it onto the extractor on the home page. It unpacks in your browser and gives you a .zip; the file is never uploaded anywhere.
Is the code inside readable?
Usually, though most extensions ship minified JavaScript, so it is compact rather than pretty. The manifest, the permission list and the file layout are always plain to read, and those answer most questions about what an extension does.
What do the permissions on these pages mean?
Each one is a capability the extension declares in its manifest. We describe what a capability allows and leave the judgement to you, because static analysis cannot know why a developer asked for something. A permission that fits the extension's purpose is ordinary; the same permission in an extension with no use for it is worth a question.
Which permission should worry me most?
Broad host access — <all_urls> or *://*/* — because it covers every site you visit, including the ones where you are logged in. It is also completely normal in ad blockers, dark modes and password managers. Reach and risk are not the same thing.
What does Manifest V2 mean on a page here?
It means the extension still targets the older extension platform, which Chrome has been phasing out. Practically it suggests the extension has not been updated in a while, and it may stop working in current Chrome.
Where does the data on these pages come from?
Two places: the extension's own manifest, read out of the package we downloaded, and its public Chrome Web Store listing. Nothing here is supplied by the developer or edited by hand.