How to Check What a Chrome Extension Can See Before You Install It

Chrome tells you what an extension is allowed to do. It tells you once, in a small box, at the moment you are trying to get on with something else — so most people click through it.

Here is how to read that box, and how to check again after you have installed something.

The one line that matters

Most extensions are fine. The line worth slowing down for is this one:

Read and change all your data on all websites

Chrome words it slightly differently between versions, but the meaning is the same: the extension can see the content of every page you open, and change it. Your webmail. Your bank. Your company’s admin panel. Not because it necessarily wants any of that, but because the permission is all-or-nothing.

Plenty of extensions genuinely need it. An ad blocker has to inspect every page. A password manager has to find the login box. A grammar checker has to read what you type. If the job happens on every site, the permission follows.

The question to ask is not whether that is bad. It is whether this tool’s job actually requires it. A tool that only does something when you click it usually does not.

Reading the install prompt

Before you install, Chrome lists what the extension is asking for. Some of the common ones, in plain English:

Two things worth knowing about that list.

It is not exhaustive. Chrome only warns about permissions it considers worth warning about. An extension can hold permissions that produce no line at all — storing settings on your machine, for example. Those are the low-risk ones, which is why Chrome stays quiet, but it does mean the prompt is a summary rather than the full list.

Fewer lines is not automatically safer. An extension with one scary-sounding permission it genuinely needs is in better shape than one that quietly asks for six.

Checking after you have installed

This is the part most people never find, and it is more useful than the install prompt.

1. Go to chrome://extensions
2. Click Details on any extension
3. Scroll to Permissions and Site access

Site access is the interesting one, because you can change it. Chrome gives you three settings:

• On click — the extension can only touch a page when you click its icon
• On specific sites — you list the sites
• On all sites — the default for anything that asked for it

If an extension is set to “on all sites” and you cannot think of a reason it needs to be, change it to on click. Most tools keep working. The ones that break, break in an obvious way, and now you know what they were doing in the background.

That single setting is the most useful thing on this page. It works on every extension you already have.

Going further: the manifest

Every extension ships a file called manifest.json that lists its permissions exactly. It is the source of truth — the install prompt is Chrome’s plain-English summary of it.

Getting at that file is easy for some extensions and awkward for others. Anything you have installed unpacked, or that publishes its source, you can open and read. For a packed extension from the store, you need to unpack the downloaded file first, which is more effort than most people want to spend on a screenshot tool.

For everyday purposes, chrome://extensions → Details tells you what you need.

What PageStill asks for, as a worked example

Since this is our guide, here is our own list. There are four, and none of them is site access.

There is no host_permissions entry in our manifest and no content scripts, which is the technical way of saying the extension has no standing access to any website. It cannot see a page until you click the icon on it, and it stops being able to see it when you leave.

You do not have to take that from us. It is on the install prompt, and it is in chrome://extensions → Details after the fact.

The extension makes one network request, once a day, and only if you have bought the editor: it sends your license key and a random install ID to check the key is still valid. That is the only thing that ever leaves your computer. Screenshots are held in memory and are gone when you close the results tab.

The short version

• Read the site-access line on the install prompt, and ask whether the job needs it
• After installing, chrome://extensions → Details → Site access → On click
• Fewer permissions is not the same as safer, but unexplained permissions are worth a pause