Skip to content

Instantly share code, notes, and snippets.

@paulirish

paulirish/how-to-view-source-of-chrome-extension.md

Last active November 29, 2025 17:23
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save paulirish/78d6c1406c901be02c2d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save paulirish/78d6c1406c901be02c2d to your computer and use it in GitHub Desktop.
Download ZIP
How to view-source of a Chrome extension
Raw
how-to-view-source-of-chrome-extension.md

Option 1: Command-line download extension as zip and extract

extension_id=jifpbeccnghkjeaalbbjmodiffmgedin   # change this ID
curl -L -o "$extension_id.zip" "https://clients2.google.com/service/update2/crx?response=redirect&os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc" 
unzip -d "$extension_id-source" "$extension_id.zip"

Thx to crxviewer for the magic download URL.

Option 2: Use the CRX Viewer website

https://robwu.nl/crxviewer/

Option 3: Use the CRX Viewer extension

The Chrome extension source viewer is open source (github repo) and makes this super easy.

Option 3: View source of locally installed extension

  1. Find your Chrome local profile directory. Open chrome://version/ and find the "Profile Path:` field. Open that folder up.
  2. Open the Extensions/ subfolder
  3. All your extensions are here, with typically readable source.

Mapping between locally installed extension IDs and names

  • On about:extensions, turn on Developer Mode and you'll see IDs under each entry
  • Inside the Extensions/ folders, the manifest.json has a readable name field

image

@stefanschmidt
Copy link

stefanschmidt commented Oct 26, 2022 •
edited
Loading

When using the above parameters for the request URL the API returns an empty response body along with an HTTP 204 status code.

$ extension_id=jifpbeccnghkjeaalbbjmodiffmgedin
$ curl --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc"
204

Adding acceptformat=crx3 to the request URL returns the extension.

$ curl --output "$extension_id.crx" --silent --location "https://clients2.google.com/service/update2/crx?response=redirect&os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc&acceptformat=crx3"

$ file "$extension_id.crx"
jifpbeccnghkjeaalbbjmodiffmgedin.crx: Google Chrome extension, version 3

The SHA-256 checksum of the downloaded file matches the value returned by the API.

$ sha256sum "$extension_id.crx"
92c3ce80364f17e54dbc9332021d9368be025bffbbe0a788e055129af2fc6853  jifpbeccnghkjeaalbbjmodiffmgedin.crx

$ curl --silent --location --output "$extension_id.xml" "https://clients2.google.com/service/update2/crx?os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc&acceptformat=crx3"

$ xml sel -N x="http://www.google.com/update2/response" -t -v "//x:updatecheck/@hash_sha256"  -n "$extension_id.xml"
92c3ce80364f17e54dbc9332021d9368be025bffbbe0a788e055129af2fc6853

Only response, prodversion, x and acceptformat seem to be mandatory parameters, at least a request with only those results in an identical file.

$ curl --output "$extension_id.crx" --silent --location "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc&acceptformat=crx3"

$ sha256sum "$extension_id.crx"
92c3ce80364f17e54dbc9332021d9368be025bffbbe0a788e055129af2fc6853  jifpbeccnghkjeaalbbjmodiffmgedin.crx

It seems further that prodversion can be any value >= 32.

@cstrouse
Copy link

cstrouse commented May 21, 2023

I ran into the same issue using the Swipe Well extension (ID: phoibianbflfapemikjhjjohoobljlgd) and the above from @stefanschmidt resolved the problem.

@korenevskiy
Copy link

korenevskiy commented May 30, 2023

Please add a button to the direct link to the CRX file

@hsandt
Copy link

hsandt commented Jun 24, 2023

Thanks! I used Option 4, it needs some work to find the correct folder, but if you just installed the plugin, just sort by folder modified date and pick the most recently modified one that is not Temp. By the way, Option 4 is incorrectly named "Option 3", so there are two "Option 3".

@Krovikan-Vamp
Copy link

Krovikan-Vamp commented Jul 6, 2023

Thanks Paul!

@disaac
Copy link

disaac commented Dec 5, 2024

@stefanschmidt Thanks for the updated curl commands. I refactored a bit to make it a copy paste snippet that automates the process of downloading, verifying, and extracting a Chrome extension to a directory with the extension_name. It also uses grep -oP to extract the sha256 from the xml in case someone doesn't want to or can't install xmlstarlet.

NOTE: This worked on the specific extension I was targeting didn't test on any others.

extension_name=disable-html5-autoplay
mkdir -p "$extension_name"
extension_id=cafckninonjkogajnihihlnnimmkndgf 
# Download the crx file
curl --output "$extension_id.crx" --silent --location "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc&acceptformat=crx3"
# Check the sha256 hash of the crx file
dlSha=$(sha256sum "$extension_id.crx" | cut -d ' ' -f 1)
# download sha info from xml file
curl --silent --location --output "$extension_id.xml" "https://clients2.google.com/service/update2/crx?os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc&acceptformat=crx3"
# Check the sha256 hash from the xml file
xmlSha=$(grep -oP 'hash_sha256="\K\w+(?=")' "$extension_id.xml")
if [[ $dlSha == $xmlSha ]]; then
 echo "SHA256 hash is correct expanding crx src"
 unzip "$extension_id.crx" -d "$extension_name"
 # Remove the crx file and xml file after extracting
 rm "$extension_id.crx" "$extension_id.xml"
else
  echo "SHA256 hash is incorrect"
fi

@1oglop1
Copy link

1oglop1 commented Dec 17, 2024

Nothing from above worked for me, I kept getting 0B responses until I replaced prodversion=44.0.2403.130 with the actual version of my browser which is 131.0.6778.109 at the time of writing this. -> prodversion=131.0.6778.109 then downloaded the file.

@zilun-wang
Copy link

zilun-wang commented Dec 22, 2024

Nothing from above worked for me, I kept getting 0B responses until I replaced prodversion=44.0.2403.130 with the actual version of my browser which is 131.0.6778.109 at the time of writing this. -> prodversion=131.0.6778.109 then downloaded the file.

Thanks for your update. This works for me.

@MD123451
Copy link

MD123451 commented Jan 7, 2025

Hm Interesting

@stefanschmidt
Copy link

stefanschmidt commented Jan 16, 2025 •
edited
Loading

tl;dr

Either set prodversion to the most recent Chrome release or use the following:

extension_id=jifpbeccnghkjeaalbbjmodiffmgedin
https://clients2.google.com/service/update2/crx?response=redirect&prodversion=2147483647&x=id%3D${extension_id}%26uc&acceptformat=crx3

Explanation

It turns out Chrome extensions have an optional manifest key minimum_chrome_version.

Apparently while making the switch from Manifest V2 to Manifest V3 extension developers are increasingly making use of it.

The extension I used as example above had "minimum_chrome_version": "88" added to the manifest in December 2023.

Behind the scenes the Google API appears to verify minimum_chrome_version by checking the value of prodversion.

So in this case a value less than 88 will result in an empty response body.

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=87&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
204

but a value >=88 will deliver the extension.

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=88&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
200

The largest value that works for prodversion is 2147483647.

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=2147483647&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
200

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=2147483648&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
204

So apparently Google uses a signed 32-bit integer variable for processing the parameter prodversion resulting in $2^{31}-1 = 2147483647$ as the maximum value.

@n0bcode
Copy link

n0bcode commented Jul 2, 2025

Perfect, Thanks!

@w3spi5
Copy link

w3spi5 commented Oct 10, 2025

Good , thanks !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment