superlevels: twelve Chrome utilities in one readable extension

One folder holding twelve separate tools

Browser extensions hold permissions that reach every page you open, and the vendor's code is normally a compiled bundle nobody reads. superlevels takes the opposite route. It is a plain JavaScript Chrome extension whose source sits in a repository you can read line by line and load into Chrome yourself, without passing through the Web Store review queue. The project description counts more than a dozen separate tools folded into one package, and the repository layout backs that up with a file per concern, including darkmode.js, livecss.js, nocookie.js, jsonformat.js, gmaps.js, viewimage.js, unhook.js, xdim.js and photopea.js. That per-feature split is the practical reason the auditability argument holds up. The tab closing logic, the cookie editing logic and the audio capture logic each live in their own file instead of one opaque bundle, so a reader can decide which parts they are willing to trust. The intended user is someone who wants several small utilities at once but does not want to grant ten different publishers access to their entire browsing history. It is also the right shape for a developer who wants to change one behaviour and keep the rest.

Loading it unpacked in developer mode

There is no package manager step and no build script to run. Installation is a Chrome developer mode workflow: obtain the folder, turn on Developer mode on the extensions page, and load the folder unpacked. The two lines that carry the meaning are the extension page address and the folder name, and the README spells out both:

2. Open Chrome and go to `chrome://extensions/`
6. Select the `superlevels` folder

The numbering on those lines comes from the README's own install list. After loading, the extension icon appears in the toolbar and the popup becomes the control surface for the features the README marks as toggleable, including the Photopea ad column switch, the per-site versus global dark mode choice and the editable paywall site list. The consequence of this route is easy to miss: nothing about it is signed by a store publisher and nothing about it updates itself. When you edit a content script in the folder you reload from the extensions page before the change shows up in the browser, and when a site redesigns itself the rule that patched it stops working until you notice and patch it yourself.

Auditing the source with an AI tool before install

The security section of the README does something unusual for a browser extension. Instead of asking for trust, it tells you to point a coding tool at the source before you install anything, and it lays out four steps:

1. Clone this repo or point your AI tool at the source code
2. Use [Cursor](https://cursor.sh), [Claude Code](https://claude.ai/claude-code), [Codex](https://openai.com/index/openai-codex/), or any AI coding tool
3. Ask it: *"Analyze this Chrome extension for security vulnerabilities, malware, spyware, data exfiltration, and any suspicious behavior"*
4. Read the report before you install

The third line is the prompt the project suggests you ask, and the surrounding text advises the same check for every other extension you already have installed. The argument is structural rather than decorative: a manifest file, background.js, popup code and per-feature scripts sit in plain view, so a reader can trace what each permission touches. What the repository does not offer is a signed build, a published checksum or a versioned artifact to compare a download against. The audit therefore covers the clone sitting on your disk, not a distributed binary, and the gap between those two things is worth keeping in mind.

Where dark mode, consent banners and the JS toggle go wrong

Three features carry real breakage risk. Dark mode is described as CSS filter inversion, which is the standard trick and also the standard reason a page looks wrong. Light artwork on a dark background, video with burned in captions, or an element that reads its own computed colors can render badly even though images and videos are re-inverted automatically. The GDPR Cookie Consent Dismisser auto-hides and auto-clicks banners across OneTrust, CookieBot, Didomi, Quantcast and dozens of other frameworks, and the README notes you can toggle it off when a site breaks, which reads as a warning as much as a feature. The JS Toggle disables JavaScript per site and reloads the page, which is useful for reading an article without popups but also disables anything the site needs to render at all. The No Paywall feature sends article URLs to archive.is while leaving homepages and section fronts alone, and it strips tracking parameters so an existing snapshot matches. The practical limit there is coverage: the behaviour only covers the publications on the list you can edit in the popup.

One unpacked folder against twelve store add-ons

The alternative to superlevels is not another tool with a similar name, it is the arrangement the project set out to replace: twelve separate extensions installed from the store, each from its own publisher. The difference in approach shows up in the permission surface and the update path. Twelve extensions mean twelve sets of host permissions and twelve background processes, each one able to read the pages you open, while one unpacked folder is one manifest, one set of requests and one code base you can diff yourself. The tradeoff runs the other direction as well. Store extensions get publisher review and automatic updates, so a broken rule on a redesigned site gets fixed without you noticing anything. An unpacked copy gets neither, which means a stale rule or an unwanted code path stays installed until you look. There is a second difference in the paywall feature specifically. superlevels performs the redirect itself, pointing at archive.is as the destination, so the trust decision covers this extension plus that service, rather than one narrow publisher.

Storage stays local except for ten seconds of audio

The privacy claim has one narrow exception, stated precisely: the only external network request is the Music Recognizer, which sends a short audio clip to ACRCloud, and only when you explicitly click Listen and supply your own API keys. Everything else stays in chrome.storage.local, with no analytics, no tracking and no phone-home behavior described anywhere. The Music Recognizer captures 10 seconds of audio from the current tab, identifies the song through ACRCloud, links the result to YouTube and keeps a history of recognized songs. It requires a free ACRCloud signup and a key you hold, which keeps the cost and the accountability with the user rather than with the extension author. The preferences elsewhere are local too. The Live CSS Editor applies custom CSS in real time as you type, saves rules per domain and supports the tab key for indentation, and the X Dim Mode ships seven palettes, Dim, Slate, Jade, Plum, Dusk, Ember and a custom hue, with live preview in the popup.

MIT licence, no releases, and a repository as the release

The licence is MIT, so you may read, modify and redistribute the code and keep your own changes, subject to the usual attribution and licence notice conditions. That is not a formality here, because the project invites forking and forking is the cheapest way to remove a feature you disagree with, such as dropping the paywall site list or deleting the audio capture code entirely. The cost lands on your side. There are no GitHub releases for this repository, so the deployment artifact is the same clone, the same developer mode toggle and the same reload from the extensions page, and there is no versioned build to diff against and no changelog to read before updating. The last push was on 2026-10-18, so the tree is current, but freshness of the tree is not the same as a stable upgrade path. Anyone adopting this should treat the repository itself as the release, keep a local copy of the working folder as the baseline, and diff your own changes against the upstream files before pulling in new commits.

Editorial conclusion

Adopt superlevels if you want a dozen utilities from one readable code base and are willing to own the upgrade cycle yourself. Skip it if you depend on store review and automatic updates, or if you only need one of the twelve functions. Before loading the folder, verify the two edges that reach the network: whether the Music Recognizer is acceptable with your own ACRCloud key, and how the paywall site list is configured for the publications you actually read.

Frequently asked questions

Official sources

1. Issues
2. levelsio/superlevels on GitHub
3. License: MIT
4. README