Open CRX files in your browser
A Chrome extension as the Web Store hands it out. Open one right here to see what it can read and change, where its scripts run and who signed it, without installing it. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your app opens like a folder, its files listed on the left, with a page beside them on what it is, who signed it and what it asks for.
- Its signature • Checked inside your browser
- SHA-256 • Compare it or look it up on VirusTotal
- Heads-ups • What it asks for and what runs
- Its files • Manifests open as text
About CRX
A CRX is a ZIP with a header in front: manifest.json names the extension and the permissions it asks for, and its scripts, pages and pictures sit beside it. Manifest V3 extensions run their background code in a service worker and change pages through scripts Chrome injects.
The header holds signatures over the ZIP: the developer's own key, whose hash is the extension's ID, and, for the Chrome Web Store's extensions, the store's key too. Chrome only installs one from elsewhere when a policy allows it.
Filepeek checks both signatures, works out the ID from the developer's key and says whether it matches the store's. It lists the permissions in Chrome's own warnings, the sites its scripts run on, and what it adds to Chrome, and links to its page on the Chrome Web Store.
Chrome extension
.crx
Format
- MIME type
- application/x-chrome-extension
- Made by
- Released
- 2009
Inside the file
- Container
- ZIP, after a CRX3 header
- Manifest
- manifest.json
- Signatures
- The developer's key and the Web Store's
- ID
- From the developer's key
Opens in every browser
No browser opens a CRX: they download it. Filepeek opens it as a folder in Chrome, Edge, Firefox and Safari.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Questions
How do I see what a Chrome extension can do before installing it?
Drop its CRX on this page or choose Peek a CRX. A page lists what it can read and change in Chrome's own words, the sites its scripts run on and what runs in the background.
Can I check a CRX's signature?
Yes. Filepeek checks the developer's signature and the Chrome Web Store's, and says whether the ID the developer's key gives matches the extension's.
How do I look up a CRX on VirusTotal?
Filepeek works out its SHA-256 inside your browser. Look up on VirusTotal opens VirusTotal's page for that hash, and only the hash goes, never the file. Compare checks it against a SHA-256, SHA-1 or MD5 you paste.
Does opening a CRX install it?
No. Filepeek only reads it: nothing in it runs, nothing is installed and it never leaves your device.
Can I get files out of a CRX?
Yes. Pick any file on the left to open it. manifest.json and its scripts open as text. In Chrome and Edge on a computer, Export extracts them all into a folder.