What Browser Extensions Are Safe to Keep

Most people install browser extensions and then forget about them. A useful tool gets added, used a few times, and then sits in the toolbar quietly accumulating permissions it does not need for tasks it is no longer doing. Some of those extensions were bought by other companies after the original developer sold them. Some request access to every page you visit because it was easier to ask for everything than to request specific permissions. A few are outright harmful.

An audit takes about fifteen minutes and most people who do it end up removing more than half of what they have installed.

What Extensions Can Actually Do

The permission that appears most often in extension requests is "Read and change all your data on all websites you visit." This is the maximum permission an extension can hold, and many tools request it when they do not need it. A colour picker that only runs when you click it does not need to read every page you visit. A grammar checker that only activates in text boxes does not need to monitor your entire browsing session.

An extension with this permission can read anything visible on a page: the text, the form fields, the data your bank displays after you log in. It can also modify what you see, injecting content or redirecting links. It runs in the browser process, which means it operates with the trust level of your browser session, not as a separate sandboxed application.

This is not to say that extensions with broad permissions are automatically malicious. A password manager needs to see form fields on every site so it can fill them in. An ad blocker needs to see every page so it can remove elements from them. The permission is appropriate to the function. The problem is extensions that request the same level of access for functions that do not require it.

How to Audit What You Have Installed

In Chrome and Edge, type chrome://extensions into the address bar. In Firefox, go to about:addons. You will see every extension currently installed, whether it is active or disabled.

For each extension, click Details and look at the permissions listed. The things to pay attention to: access to all websites (vs access to specific sites), access to your browsing history, ability to read and modify data on pages, access to tabs and clipboard. None of these are automatically disqualifying, but each one is worth asking: does this tool actually need this to work?

Remove anything you have not actively used in the past three months. If you cannot remember what it does, that is a reliable signal it is not earning its permission set. Extensions do not stop having permissions just because you stop using them.

Check the developer for anything you keep. Search the extension name plus "sold" or "acquired" to see whether the original developer still owns it. There is a documented pattern of useful extensions being acquired by companies whose primary interest is the user data the extension collects, not the function the extension performs. A coupon-finding tool or a tab management extension is particularly attractive to acquire because it has broad permissions and a large user base that never checks who owns it now.

Extensions Worth Keeping and Red Flags to Watch

The extensions that consistently earn their permissions: a password manager with browser integration (the broad access is necessary for autofill to work), a content blocker such as uBlock Origin (the access to all pages is the entire point), and any extension made by the same company as software you are already using and trust.

Red flags that suggest an extension is worth removing even if it seems useful: it was installed as part of another application's setup process without a clear prompt, it has recently changed ownership and the reviews have dropped sharply, the developer's privacy policy is vague about what data is collected and where it goes, or the extension has not been updated in over a year despite active browser updates around it.

Extensions that have shown up repeatedly as problems in security research: shopping assistants that track browsing history as their actual business model, PDF converters that upload files to process them then retain copies, and browser themes that include tracking scripts alongside the cosmetic changes.

After the Audit

Once you have removed what you do not need, two steps are worth taking. First, for extensions you keep, change the site access setting from "On all sites" to "On click" where the option exists. This limits the extension's ability to run passively on every page and restricts it to running only when you actively invoke it. For an ad blocker this would defeat the purpose. For most other extensions, it is the right default.

Second, consider which extensions you actually need installed all the time versus which ones you use occasionally. An extension can be disabled when not in use and re-enabled when needed, which removes its access entirely in the interim without requiring you to set it up again.

The goal is not a browser with no extensions. Several extensions are genuinely useful and worth the permission trade-off. The goal is to know exactly what you have installed, why it needs the access it has, and whether the developer who holds that access is still the one you originally decided to trust.