CRX Viewer: Inspect Browser Extensions and Zip Archives

Why CRX Viewer Opens Extension Packages Without Installation

CRX Viewer addresses a specific gap between browser extension distribution and source inspection. A user may find an extension in a browser gallery but need to examine its JavaScript, manifest, images, or nested archives before deciding whether to install it. The README says CRX Viewer can show the source of a Chrome extension without installing it. The same project also supports Opera, Firefox, Thunderbird, and Microsoft Edge add-on listings, which makes it useful to developers and reviewers who inspect packages across browser ecosystems.

The intended users include extension developers reviewing a package, support engineers diagnosing an add-on, and security researchers examining what an archive contains. The project is not a general file manager first. Its interface is organized around archive contents, source search, links between files, and downloads derived from supported extension sources.

The online demo accepts a local `.crx`, `.nex`, `.zip`, or `.xpi` file, or a URL. That input model makes it useful even when the archive did not come from one of the supported galleries. The viewer also documents viewing any URL or Zip file, although the precise handling rules for unsupported URLs are not stated in the README. The repository's stated purpose therefore covers both browser-gallery workflows and direct archive inspection.

Gallery Integration and the Two Available Actions

In supported extension galleries, CRX Viewer adds a button to the right of the browser omnibox after it detects a CRX file. The README lists the Chrome Web Store, Opera add-ons gallery, Firefox add-ons gallery, Thunderbird add-ons gallery, and Microsoft Edge Add-ons store. Clicking the button exposes two actions: downloading the extension as a Zip file and viewing its source.

The browser UI also has a preference named `Primary action on click`. Changing this preference through the extension context menu determines what happens before the two-action menu appears. That is a small but useful separation between a direct primary action and access to both archive operations.

For packages hosted outside the recognized stores, the README says CRX Viewer can inspect Chrome, Opera 15+, and Firefox extensions hosted elsewhere. It can also offer a context-menu command on links that target Chromium extensions. Both behaviors are controlled from the options page. This design gives browser users two entry paths: automatic discovery in a gallery or manual invocation against an extension link.

The documentation does not describe support for every legacy Firefox format, although it explicitly mentions WebExtensions and other Firefox add-on types in its store availability. It also does not explain what happens when gallery markup changes and the omnibox button cannot be detected. That makes store integration a convenience boundary rather than a guarantee that every listing will work indefinitely.

Inside the Searchable Source Viewer

Opening `View source` creates a new tab containing a file-oriented interface for the selected extension or archive. The file list supports filtering by regular expression, so a developer can narrow a large package to paths matching a pattern. Search can locate files containing a literal string or content matching a regular expression. The interface also permits movement between results and navigation to a specific line.

The viewer performs presentation work after retrieval. It documents automatic code beautification, syntax highlighting, image preview, and permalinks for files and search results inside a Zip or extension archive. These features are aimed at inspection rather than editing. The README does not describe saving modified source or rebuilding an extension, so the repository should not be treated as an extension development environment.

CRX Viewer also displays MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for file content. It can open embedded Zip files as content within the existing inspection flow. For Chrome Web Store extensions, it can request a download for another platform, with Chrome OS and NaCl named as examples. Downloads are available from the viewer as Zip or CRX. The exact server-side conversion and download sequence is not documented in the README.

First Use Through the Browser Demo

The README does not provide installation commands for building CRX Viewer from the repository. It directs users to the hosted add-on listings for Chrome and Opera, the Firefox add-on listing, and the online demo. It also says the source is covered by the Mozilla Public License, version 2.0.

For a first use without building the repository, open the documented online demo at `https://robwu.nl/crxviewer/`. Choose a `.crx`, `.nex`, `.zip`, or `.xpi` file from disk, or supply a URL. After the viewer loads the input, use its file list to locate a manifest, script, or image. Enter a string or regular expression in the search interface, then move between matching files or lines.

For image inspection, select a supported image from the archive to use the preview. To inspect a nested archive, select the embedded Zip entry. The upper-right controls provide Zip and CRX downloads. For gallery access, install the listed browser add-on from its supported store, visit a recognized extension listing, and use the button to the right of the omnibox. The README does not document an offline build procedure, local development server, automated tests, or release command, so this tutorial does not invent one.

Repository Build Scope and Unspecified Release Operations

Based on the repository layout, the project separates browser-specific packaging from shared source. Top-level entries include `chrome-web-store/`, `opera-addon-gallery/`, `firefox-stuff/`, `external/`, `src/`, and `make.js`. This structure suggests distinct artifacts or support code for Chromium and Firefox targets, but the README does not describe the contents or build sequence of each directory.

The `package.json` identifies the package as `crxviewer`, sets its version to `0.0.0`, marks it as private, and declares `less` and `shelljs` as development dependencies. It describes these as tools and dependencies used to build CRX Viewer. No `scripts` field is present in `package.json`, so there is no documented npm command for building, testing, or publishing. The repository also gives no Node.js version requirement.

The repository is not archived, and the last push was on 2026-09-01. However, it has no GitHub releases. There is therefore no release history here against which to compare upgrades, and the README documents no migration notes, compatibility matrix, automated tests, or rollback procedure. The `0.0.0` package version should not be treated as the installed add-on version because the package is marked private and described as a build-tooling package rather than a published release.

The MPL-2.0 license permits use and modification under its terms, but distribution and file-level obligations should be reviewed by the responsible project maintainer. This review is a license-compliance step, not legal advice.

CRX Viewer Compared with Local Archive Extraction

The clearest alternative is to download an extension package with ordinary archive tools and inspect it locally. A local `.zip` workflow places the user in control of extraction, directory navigation, text editing, and external search tools. It also avoids sending a selected URL or archive to the hosted demo. For a package that is already available as a trustworthy local file, that approach may be simpler.

CRX Viewer takes a different path. It recognizes extension-store pages, offers source inspection from the gallery context, understands extension-related archive inputs, renders code and images, calculates several hashes, and exposes permalinks to archive content. The web application can also inspect a URL or embedded Zip directly. Those are inspection features built around extension archives rather than general filesystem access.

The trade-off is dependency on the web application for the hosted workflow. A local extraction tool can continue to open an archive without a network service, while CRX Viewer's online demo necessarily depends on its site being reachable. The gallery add-on also depends on compatible store-page detection and browser integration. Neither approach should be assumed to validate an extension's security. Hash display and source visibility can assist review, but the README makes no claim that they prove safety or absence of malicious behavior.

Editorial conclusion

CRX Viewer fits developers, security reviewers, and support engineers who need read-only inspection of extension packages, particularly when an archive cannot be installed in its target browser. It is a poor fit for teams that require documented production builds, formal releases, or a stated rollback process. Before adoption, check that the web demo accepts the required archive types, confirm the behavior of gallery downloads on each supported store, and review the MPL-2.0 obligations with whoever handles the project's licensing.

Frequently asked questions

Official sources

1. Issues
2. License: MPL-2.0
3. Project website
4. README
5. Rob--W/crxviewer on GitHub