Free Chrome extension scanner
Scan any Chrome extension for hidden risks
Permissions tell you what an extension could do. This tells you what it actually does. Paste an extension ID or name and see the network calls, data access and behaviour behind it - with the evidence attached.
How do I check if a Chrome extension is safe?
Reading the permission list isn’t enough. Safe extensions routinely ask for broad access, and data-harvesting ones can look modest on paper. The reliable signal is behaviour: what the extension’s code does when it runs.
Am I Being Pwned scans a Chrome extension by loading it into an instrumented browser, driving it against live sites, and capturing the requests it makes, the data it reads, and anything it sends out. You get a keep-or-remove verdict with that captured evidence attached, so the answer holds up to a second opinion.
What the scan looks for
- Data exfiltration: session cookies, page content or form data sent to unknown endpoints
- Over-broad permissions that don't match what the extension actually does
- Obfuscated or encoded payloads hiding what the code sends
- Silent updates that change behaviour after you install
- Third-party trackers and analytics loaded into every page you visit
- AI chat scraping: quietly harvesting your ChatGPT, Claude or Gemini conversations
How to scan a Chrome extension
Two ways in: check one extension for free above, or scan every extension across your whole organisation at once.
- 1
Paste the extension
Enter the Chrome extension's name, or its 32-character ID from the Web Store URL. You don't need an account to scan a single extension.
- 2
We look up our analysis
If we have analysed it, you see what our sandbox captured when we ran it against live sites: the network calls, DOM changes and messages its code produced, beyond the permissions it declares. We rescan as new versions ship.
- 3
Get a verdict with evidence
You get a clear risk level backed by the captured behaviour: the endpoints it hit, the data it read, and anything it sent out. Every finding is tied to the evidence behind it. Extensions we have not analysed yet are marked as such, never as clean.
- 4
Scan your whole fleet
Connect Google Workspace to scan every extension installed across your org at once, and get alerted when an extension ships a risky update.
Frequently asked questions
How do I scan a Chrome extension for viruses or malware?
Paste the extension's name or its ID into the scanner above. If we have analysed it, you see what its code did when our sandbox ran it against live sites - the network requests it made, the data it read, and anything it sent out - with a risk verdict and that evidence attached. A malicious extension shows its behaviour, not just a suspicious permission list. If we have not analysed it yet, the scanner says so rather than calling it clean.
Is this Chrome extension safe? How can I tell?
Permissions alone can't tell you. Plenty of safe extensions ask for broad access, and plenty of data-harvesting ones look modest on paper. The reliable signal is behaviour: what the extension does when it runs. Scan it above to see whether it stays within its stated job or quietly reads and sends data it has no reason to touch.
Where do I find a Chrome extension's ID?
Open the extension's Chrome Web Store page. The 32-character string of letters at the end of the URL (after /detail/name/) is its ID. You can paste either the ID or the extension name into the scanner.
Is the extension scanner free?
Yes. Scanning a single extension is free and needs no account. To scan every extension across your organisation at once and get alerted on risky updates, connect your Google Workspace for a free fleet scan.
How is this different from the Chrome Web Store's own review?
The Web Store checks an extension at submission and relies heavily on declared permissions and reputation. It doesn't show you what the extension did when run against live sites. Extensions have also gone bad after they were approved, through silent updates or an ownership change. A behavioural scan reflects what the current version does right now.
Scan every extension in your fleet, with evidence.
Free for up to 20 devices, or scan your Google Workspace in a few minutes.