Extension Permission Inventory — TPCI

See what your extensions can actually do, ranked by access level. No scanning, no verdicts — just your permissions, sorted.

What can your browser extensions actually do? Most people install extensions without a second look at what they're permitted to access. This tool surfaces that information in plain language — not to tell you an extension is safe or dangerous, but to make it easier to spot anything that doesn't match what an extension is supposed to do. HOW IT WORKS Every installed extension declares what it wants access to in its manifest. This tool reads those declared permissions and sorts your extensions from broadest access to narrowest, so the ones worth a closer look are at the top. Each extension expands to show two things: Sites it can access — the specific domains or patterns it's permitted to read and modify Browser capabilities — what APIs it can use (cookies, history, clipboard, etc.) The plain-language explanations are designed to be readable without a technical background. WHAT IT DOESN'T DO This is not a malware scanner. It does not inspect extension code, contact any remote server, or tell you whether an extension is malicious. "Review carefully" means the permission is broad enough to warrant a look — not that anything is wrong. Whether a permission makes sense is a judgment only you can make, because you know what each extension is supposed to do. YOUR DATA No data leaves your device. The extension makes zero network requests. You can verify this by checking the manifest — the only permission requested is "management" (to read installed extensions), with no host permissions at all. AFTER INSTALLING Two optional settings worth knowing about: Allow access to file URLs — not needed for this extension, safe to leave off Collect errors — a developer debugging tool, safe to turn off for normal use Find both under chrome://extensions → Details (next to this extension). To keep the icon handy, right-click the puzzle piece in your toolbar → Pin "Extension Permission Inventory". BACKGROUND Built by The Privacy Commons Institute (tpc.institute) as a companion to our research on malicious Chrome extension persistence. Our paper "Still There" found that 20.9% of documented malicious extensions remained live after disclosure — partly because most users have no way to judge whether an extension's permissions match what it's supposed to do. This tool is a small step toward closing that gap. Open source. No ads. No tracking. No cost.