Open XPI files in your browser
A Firefox add-on, as addons.mozilla.org hands it out. Open one right here to see what it can read and change and whether Mozilla signed it, without installing it. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your app opens like a folder, its files listed on the left, with a page beside them on what it is, who signed it and what it asks for.
- Its signature • Checked inside your browser
- SHA-256 • Compare it or look it up on VirusTotal
- Heads-ups • What it asks for and what runs
- Its files • Manifests open as text
About XPI
An XPI is a ZIP with manifest.json naming the add-on, its ID and the permissions it asks for, and its scripts, pages and pictures beside it. Firefox add-ons are WebExtensions, like Chrome's, with a few APIs of their own.
Firefox only installs add-ons Mozilla has signed, listed on addons.mozilla.org or not. The signature lists every file's digest in META-INF and signs it twice, in COSE and in PKCS#7, with a certificate issued for the add-on's ID under Mozilla's own root.
Filepeek checks Mozilla's signature, the certificate chain to Mozilla's root and every file's digest, and says if a file was changed or added. It lists the permissions in Firefox's own words and the sites its scripts run on, and links to its page on addons.mozilla.org.
Firefox add-on
.xpi
Format
- MIME type
- application/x-xpinstall
- Made by
- Mozilla
Inside the file
- Container
- ZIP
- Manifest
- manifest.json
- Signature
- Mozilla's, in COSE and PKCS#7
- Digests
- Every file, in META-INF
Opens in every browser
No browser opens an XPI: they download it. Filepeek opens it as a folder in Chrome, Edge, Firefox and Safari.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Questions
How do I see what a Firefox add-on can do before installing it?
Drop its XPI on this page or choose Peek an XPI. A page lists what it can read and change in Firefox's own words, the sites its scripts run on and what runs in the background.
Is this XPI signed by Mozilla?
Filepeek checks the signature, its certificate chain to Mozilla's add-ons root and every file's digest, and says whether it holds.
How do I look up an XPI on VirusTotal?
Filepeek works out its SHA-256 inside your browser. Look up on VirusTotal opens VirusTotal's page for that hash, and only the hash goes, never the file. Compare checks it against a SHA-256, SHA-1 or MD5 you paste.
Does opening an XPI install it?
No. Filepeek only reads it: nothing in it runs, nothing is installed and it never leaves your device.
Can I get files out of an XPI?
Yes. Pick any file on the left to open it. manifest.json and its scripts open as text. In Chrome and Edge on a computer, Export extracts them all into a folder.