CrxRay

Inspiration

Most people install browser extensions and accept privacy prompts in seconds. The information that matters is usually hidden behind technical permission lists, tracker names, and confusing cookie notices.

We built CrxRay to make those browser privacy decisions easier to understand. Instead of treating every permission or tracker as automatically dangerous, CrxRay gives users clear context about what is being requested and what they may want to review.

What it does

CrxRay is a browser privacy inspector with two tools:

Extension scan: Paste a Chrome Web Store link or extension ID to inspect its publicly available manifest. CrxRay translates requested permissions into plain-language risk signals, gives a simple grade, and suggests practical actions before installation.
Website privacy scan: Enter a public website URL to check for common tracker signals, consent-management tools, and third-party scripts. The report gives users more context before accepting a cookie prompt or continuing on a site.

The goal is not to label software or websites as malicious. It is to help everyday users ask better questions before they install, accept, or continue.

How we built it

CrxRay was built as a React and Vite web application with a custom responsive interface designed for phones as well as laptops.

For extension scans, a Vercel serverless function retrieves the public Chrome extension package, reads its "manifest.json", and maps relevant permissions to understandable privacy and security signals.

For website scans, another Vercel serverless function checks a public page for common analytics, advertising, session-recording, consent-management, and third-party script signals. We added safeguards so the scanner does not fetch local or private network addresses.

We used JavaScript, React, Vite, Node.js serverless functions, Vercel, GitHub, CSS, Lucide icons, and AdmZip for reading extension packages.

Challenges we ran into

The main challenge was making the results useful without overstating what they mean. A password manager, ad blocker, or translator extension may request powerful permissions for legitimate reasons. We therefore designed CrxRay around transparent evidence and practical next steps rather than claiming that a high-risk signal proves something is harmful.

We also worked on making reports readable on mobile devices, including long URLs, extension IDs, and technical terms that can easily overflow a small screen.

What we learned

We learned how browser extension manifests expose real privacy-relevant information, how public websites load trackers and consent tooling, and how much care is needed when communicating security information to non-technical users.

Most importantly, we learned that cybersecurity tools can be useful without being intimidating. Clear explanations can help people make safer digital decisions every day.

AI and external tools disclosure

AI tools assisted with planning and implementation during development. Demosmith was used to create the project demonstration video from the real deployed CrxRay website. CrxRay does not use AI as a runtime feature.