Loading page
About this tool
Highlight risky extension permissions and combinations in a manifest.
Paste an extension's manifest.json and this tool parses it the way a reviewer would: it separates API permissions from host match patterns (which Manifest V2 mixes into the same array), validates every pattern against the <scheme>://<host>/<path> grammar, reads the content_scripts entries down to run_at, all_frames and world, identifies the background type, and parses the Content Security Policy directives. Each permission is matched against a fixed catalogue that says what the API actually allows. On top of that it applies combination rules — broad host access plus scripting, cookies plus all sites, nativeMessaging plus page access — because the permissions that matter most are usually the ones that only become dangerous together. Nothing is uploaded and no store is contacted.
Open Browser Extension Permission Analyzer on AltFTool — it loads instantly in your browser.
Paste the extension's manifest.json into the 'manifest.json' box — find it at chrome://extensions, then Details, then the extension folder or the unpacked source.
API permissions are split from host match patterns, every pattern is validated, content_scripts are read down to run_at, all_frames and world, and the background type and Content Security Policy are parsed.
Read 'Combinations that matter', then the 'Declared permissions' table's Permission, Class and 'What it allows' columns alongside 'Host access' and 'Content scripts', and press 'Copy report'.
Match patterns are parsed and validated, V2 and V3 layouts are handled separately, and malformed patterns are reported with the reason they are invalid.
Broad hosts with the scripting API, cookies across all sites, nativeMessaging alongside page access, a persistent background page holding a blocking webRequest listener — each is called out with what it enables.
Every permission carries a fixed tier from a published description of the API. There is no invented number, no confidence percentage and no randomness anywhere in the analysis.
No. A manifest describes what an extension is allowed to do, not what it does. An extension with <all_urls> may never read a page, and one with only activeTab can still abuse the tab you grant it. Treat the output as the ceiling on damage, then decide whether the extension's stated purpose justifies that ceiling.
Because they are not in the install prompt. An extension can ship with a modest permission set, get installed, and later call chrome.permissions.request() for something much broader at a moment when the user is likely to click through. If a critical or high-tier permission is declared as optional, the prompt you approved is not the ceiling.
The tool retries with comments stripped and tells you it did, because manifests copied out of repositories often carry annotations. A browser will not do that — manifest.json must be strict JSON, so an annotated manifest is a packaging bug worth fixing.
webRequest hands the extension the details of every matching request, and webRequestBlocking additionally lets it rewrite or cancel each one before it is sent. declarativeNetRequest applies rules the browser evaluates, so the extension changes traffic without seeing it — unless declarativeNetRequestFeedback is also declared, which reports back which rule matched which request and largely undoes the privacy benefit. The tool tiers these from moderate up to critical depending on what each one can actually do.