How to check what your Chrome extensions can see

To check what a Chrome extension can see, open chrome://extensions, click Details on the extension, and read the Site access setting. It says "On all sites", "On specific sites" or "On click", and whichever it says is the full extent of what that extension can read. The rest of this guide covers what each setting means, what to look for, and how to narrow an extension's access without uninstalling it.

Most people install a Chrome extension, click through the permission prompt, and never think about it again. That's worth revisiting, because the permission you clicked through decides how much of your browsing the extension can read.

An extension with access to a site can see everything on it. Every keystroke, every paste, every page. Passwords, messages, documents you're drafting. That's not a flaw, it's how extensions work. They need to read the page to do their job. But it means the question isn't whether an extension can see what you type, it's which sites it can see you on.

Where to look

Open a new tab and go to chrome://extensions. Click Details on any extension and find the Site access setting. It'll say one of three things.

• On all sites means the extension can read everything you do in the browser, on every site you visit.
• On specific sites means it lists exactly which ones. Nothing outside that list.
• On click means it runs only when you click its icon, and only on the tab you're on.

What to look for

An extension that only needs to work on one site but has access to all of them. A coupon finder doesn't need to read your bank login. A YouTube tweak doesn't need your email.

Extensions you installed years ago and forgot. They keep whatever access they had on day one, and they update silently. The extension you trusted in 2022 may not be maintained by the same people now.

Anything where "all sites" isn't obviously needed for what it does. If you can't explain why it needs that much, it probably doesn't.

What you can do

You can change the setting without uninstalling. Under Site access, restrict any extension to specific sites, or switch it to "on click". Most extensions keep working fine.

Read the re-approval prompt. When Chrome asks you to re-approve an extension after an update, it's because the extension added new sites. Read the list before you click Enable. Chrome doesn't name the sites in the prompt, so you may need to check the extension's own documentation. When we added four new platforms to PiiBlocker in version 1.5.0, every user got that prompt, and we published the full list of sites alongside it. That's the system doing its job.

Keep fewer extensions. Fewer extensions with narrower access is better than many with broad access.

Check the Chrome Web Store listing before installing anything. Under Privacy practices, it shows what the extension asks for and how the developer says it handles data.

What PiiBlocker asks for

Since this is our blog, it's fair to hold ourselves to the same test. PiiBlocker has access to exactly seven sites, the AI chat platforms it protects: ChatGPT, Claude, Gemini, Grok, DeepSeek, Kimi and Perplexity. It cannot read anything else. The full list is in our privacy policy, and you can confirm it yourself at chrome://extensions under Site access. For what it does on those seven sites, see how PiiBlocker works.

Frequently asked questions

Can a Chrome extension see my passwords? If it has access to the site where you type the password, yes. An extension with access to a site can read everything on that page, including what you type into it. That is why the list of sites an extension can reach matters more than anything else about it.

How do I see which sites a Chrome extension can access? Go to chrome://extensions, click Details on the extension, and look at Site access. It will say "On all sites", "On specific sites" with the list shown, or "On click".

Can I limit an extension's access without removing it? Yes. Under Site access you can restrict an extension to specific sites, or set it to "On click" so it only runs on the current tab when you click its icon. Most extensions keep working fine.

Why is Chrome asking me to re-approve an extension? Because an update added new sites to what the extension can read. Chrome disables the extension until you approve. The prompt doesn't name the sites, so check the extension's documentation before you click Enable.

Which sites can PiiBlocker read? Seven: ChatGPT, Claude, Gemini, Grok, DeepSeek, Kimi and Perplexity. It cannot read any other site.