What can a browser extension see on the pages you visit?
Private Writing Assistant
Check grammar and rewrite text with AI that runs on your device. Free.
Add to Chrome
Add to Safari
Chrome shows a short warning before it adds an extension. For a grammar checker it usually says the extension can “read and change all your data on all websites”. It sounds alarming, and most people add it anyway, because the extension can't work without it. Both reactions miss what the warning can and can't tell you.
In short
An extension with access to a website can read and change everything on it, including what you type into its fields. Chrome tells you which sites an extension can access before you install it. Since a permission says what an extension can do, not what it does, also check where it sends what it reads.
What the permission warning means
When you add an extension, Chrome shows the permissions it asks for. The one that matters most is site access. “Read and change all your data on all websites” means the extension can run its own code on every page you open. That code can see the page's text, the forms you fill in and what you type, and it can change what the page shows.
Other common permissions are narrower: “Read your browsing history” covers the list of sites you visit, “Manage your downloads” covers your downloaded files. Each warning describes what the extension could do if it wanted to.
Why so many extensions ask for all websites
Some extensions genuinely need it. A password manager has to fill in login forms wherever they are. An ad blocker has to look at every page. A grammar checker has to see the text fields you type in, and you might type on any website.
So “all websites” isn't a red flag by itself. It means the extension is in a position of trust, and the question moves to what it does with that position.
A permission says what's possible, not what happens
Chrome can tell you what an extension is allowed to read. It can't tell you whether the extension sends what it reads to a server. Two extensions with exactly the same permissions can behave in opposite ways: one checks your text on your computer, the other uploads every keystroke.
To find out which kind you have, you need to look beyond the permission list.
Five checks before you install
- Read the permissions and ask whether each one fits the job. A note-taking extension that wants your downloads deserves a second look.
- Read the privacy policy's section on content. It should say plainly whether what you type or what's on the page leaves your device. Our post What should a writing tool's privacy policy tell you? lists the questions to ask.
- Read the store listing's privacy section. The Chrome Web Store shows what data the developer says the extension collects.
- Check that a real developer stands behind it. A website, a contact address and a history of updates are good signs.
- Limit site access if you can. In Chrome's extension settings, you can often restrict an extension to specific sites or to “On click”. That breaks some extensions, but it's worth knowing for the ones that work without it.
Our permissions, explained
Private Writing Assistant asks for access to all websites, because you can write on any of them. Here is each permission and what it's used for:
- Access to websites: to find text fields and underline mistakes on the pages you write on.
- Scripting: to load the extension's checking code into tabs that were already open when you installed or updated it.
- Storage: to keep your settings, such as the websites where you turned checking off.
- Offscreen document: to run the on-device model in the background when needed.
- Favicons: to show website icons in your list of sites where checking is off.
What it reads is checked by Chrome Built-in AI on your computer. The text you write is never sent to us or to an AI service. The extension does send usage stats, such as which features you use and the website's name, which you can turn off in settings. The privacy policy lists everything, and you can turn checking off on any website you'd rather it stayed away from.
Add Private Writing Assistant to Chrome knowing exactly what it does with that access: our privacy policy lists all of it.