Free CRX Extractor: View Extension Source and Permissions

How to Use the CRX Extractor

1. Get the extension file

   Use a .crx you packed yourself, a .xpi saved from addons.mozilla.org, or a .zip of an extension folder. This page never downloads extensions for you, so the file always comes from you.

2. Drop it on the box

   Or click the box to choose a file. The tool reads the CRX header, finds where the zip archive starts and unpacks it in memory.

3. Read the summary and permissions

   You get the name, version, manifest version and extension ID, then every permission with what it allows, the exact warning Chrome shows at install, and a low, medium or high risk level.

4. Browse the source code

   Click any file in the tree to read it. Text files open in the viewer, images show as a preview, and other binary files are listed with their size.

5. Download the unpacked zip

   The download is the archive without the CRX header, so any unzip tool opens it. To run it, unzip it, turn on Developer mode in chrome://extensions and choose Load unpacked.

What Happens to the File You Drop, and What the Tool Can’t Do

The file never leaves your computer. Your browser reads it into memory in this tab, and everything else happens there too: the header parsing, the unzip (JSZip, which loads only after you drop a file) and the SHA-256 hash for the extension ID, which uses the browser’s built-in Web Crypto. No request carries the file or anything from it, nothing is stored, and closing the tab discards it.

Exactly what gets read: the first bytes, to tell a CRX from a zip; the CRX3 header, for the public keys and the signed extension ID; manifest.json; the messages.json file for the default language, to turn placeholders like __MSG_appName__ into the real name; and any file you click.

• It doesn’t verify signatures. It reads the keys and the signed ID, but it doesn’t check the RSA or ECDSA signatures, so a tampered file still opens. Chrome checks them when you install.
• It reads code, it doesn’t run it. A permission list tells you what an extension could do, not what it does.
• The install warnings are worked out from Chrome’s published rules. Chrome merges some of them, so the real dialog can be slightly shorter.
• Minified or obfuscated code opens, but it’s hard to read. Look for a .map file next to it, which sometimes holds the original source.
• Safari extensions come inside Mac apps, not in a CRX or zip, so the tool can’t open them.

Error messages: “isn’t a CRX, XPI or ZIP file” means the first bytes are neither “Cr24” nor “PK”, often because a web page was saved instead of the file. “Header says it is longer than the file” means the download stopped early. “No manifest.json” means the zip isn’t an extension.

What Is a CRX File?

A CRX file is a Chrome extension package: a zip archive of the extension’s folder with a signed header in front of it. Chrome, Edge, Brave, Opera, Vivaldi and Arc all use the format. The header does two jobs. It carries the developer’s public key, which fixes the extension’s ID, and it carries signatures that let the browser check that nobody changed the files after they were packed. Packages from the Chrome Web Store carry a second signature from the store.

Because of that header, a CRX is a zip with extra bytes at the start. Some unzip tools skip them and open it anyway, and others report a damaged archive. A CRX extractor cuts the header off at the right byte before it unzips. There have been two versions. Current Chromium accepts only CRX3, so CRX2 files are mostly old downloads.

How Do I Get an Extension’s CRX File?

This page deliberately doesn’t fetch extensions. These are the legitimate ways to get the file:

• Pack your own. In chrome://extensions, turn on Developer mode, click Pack extension and choose the extension’s folder. Chrome writes a .crx and a .pem file. The .pem is the private key: keep it secret, because you need it to publish updates under the same ID.
• Know the Chrome Web Store link format. A store page looks like chromewebstore.google.com/detail/name/ followed by the 32-letter extension ID. Chrome downloads packages from the update service at clients2.google.com/service/update2/crx, asking for that ID and your Chrome version. Downloader sites and viewer extensions call the same service. Whether you may do that depends on the store’s terms and the extension’s license.
• Use a source viewer extension. Several extensions, found by searching the store for “CRX viewer”, add a button to store pages that opens or saves the package. Check what they ask for with this tool first.
• Save a Firefox add-on. On addons.mozilla.org, right-click Add to Firefox and choose Save Link As. You get the signed .xpi without installing it.
• Zip an installed copy. Every Chromium browser keeps unpacked copies in the Extensions folder of your profile, one folder per ID. Zip the version folder and drop the zip here.

Every Chrome Extension Permission Explained

Chrome extension permissions are the capabilities an extension declares in manifest.json. Chrome shows a warning at install for the risky ones and grants the rest silently. The table lists every permission that triggers a warning, with Chrome’s exact wording, plus the powerful ones that don’t. The risk level is our judgement of what a dishonest extension could do with it.

Some warnings merge. With access to all sites, Chrome drops the “Read your browsing history” line from “tabs”, because the all-sites warning already covers it. With both “sessions” and “tabs”, the line becomes “Read your browsing history on all your signed-in devices”. Permissions not listed here show no warning and are low risk.

Host Permissions vs API Permissions

API permissions, like “tabs” or “bookmarks”, unlock a browser feature. Host permissions decide which websites an extension can read and change. They are match patterns such as https://github.com/*, and in Manifest V3 they live in host_permissions. Chrome also counts the sites listed under content_scripts, because code injected into a page can read everything on it.

Host permissions matter most. An extension that can read and change a page can see what you type into it and change what you see, on your email and bank too if the pattern covers them. You can narrow access after installing: right-click the extension’s icon, open “This can read and change site data”, and pick when you click the extension, on specific sites, or on all sites.

How Is a Chrome Extension ID Generated?

A Chrome extension ID is 32 letters from a to p, and it comes from the developer’s public key. Chrome hashes the key (in DER SubjectPublicKeyInfo form) with SHA-256, keeps the first 16 bytes, writes them as 32 hex digits and maps each digit 0–f to a letter a–p. So “0” becomes “a” and “f” becomes “p”. The same key always gives the same ID, which is why the ID survives updates and why losing the .pem key means publishing under a new ID.

Chromium’s own test file valid_no_publisher.crx3 is a good check: its key gives the ID ojjgnpkioondelmggbekfhllhdaimnho. This tool finds the same ID when you drop that file. In a CRX3 the ID is also written into the signed header, and the tool shows which key matches it.

Unpacked extensions with no key get an ID from a hash of their folder path, so moving the folder changes the ID. Developers pin it by copying the public key into the “key” field of manifest.json, and the tool reads that too. Firefox works differently: the ID is an email-style name or a GUID set in browser_specific_settings.gecko.id.

Chrome Extension Source Viewer: How to Read the Code

Extensions are JavaScript, HTML and CSS, so the source is right there once the package is unzipped. Start with manifest.json. It names the background service worker, the content scripts and the pages the extension opens. Then read the files it lists: the service worker runs all the time the extension is active, and content scripts run inside the sites in their matches list.

When reading code, look for network calls (fetch, XMLHttpRequest, WebSocket, sendBeacon) and where they send data, for eval or new Function, and for code that builds URLs from the pages you visit. Manifest V3 forbids running code downloaded from a server, but an extension can still send data out.

Red Flags Before You Install an Extension

These are the signs worth stopping for before you click Add:

• It wants all your sites when its job involves one. A coupon tool for one shop doesn’t need your email.
• It asks for history, cookies, clipboardRead, management, nativeMessaging, proxy or debugger without an obvious reason.
• Its content scripts match <all_urls>, so its code runs inside every page you open.
• An update adds a permission. Chrome disables the extension until you accept, and that pause is your chance to ask why.
• Its update_url points somewhere other than a browser store.
• Its security policy allows unsafe-eval, or its code is heavily obfuscated with no source map.
• It changed owner recently, or its store page and its permissions describe different things.
• It is still Manifest V2. Chrome has stopped running those, so the file is old or not meant for Chrome.

Manifest V2 vs Manifest V3: What Changed?

The manifest_version field tells you which rules an extension follows. Chrome disabled every MV2 extension in Chrome 138 in July 2025, removed MV2 support in Chrome 139, and removed the last MV2 extensions from the Chrome Web Store on 31 August 2026. Firefox supports both versions and has said it has no plans to drop MV2.