Two questions about a suspicious link, email, SMS or QR code, then what to check and do.
New
Extension ID Lookup
Runs locallyNew
Use Extension ID Lookup
What it does
Find out which browser extension an ID belongs to and how risky it is: store links for Chrome, Edge and Firefox, and a plain-language reading of the permissions in its manifest.
It runs entirely in your browser: nothing you enter is uploaded.
Example
A "wallet helper" with broad access
nkbihfbeogaeaoehlefnkodbefgpgknn
---
{"name": "Wallet Helper", "manifest_version": 3, "permissions": ["storage", "clipboardWrite", "scripting", "tabs"], "host_permissions": ["<all_urls>"]}BROWSER
Chrome or Edge (Chromium)
EXTENSION ID
nkbihfbeogaeaoehlefnkodbefgpgknn
Chrome Web Store
↗
(new tab)
Microsoft Edge Add-ons
↗
(new tab)
An ID that no store knows was installed from outside the store (developer mode, a ZIP, a policy): treat it with suspicion.
Wallet Helper · Manifest V3
Wallet-drainer pattern: access to every website together with clipboard or script injection is how fake wallet and “crypto helper” extensions swap addresses and read seed phrases.
Permissions and what they allow
PERMISSION RISK WHAT IT ALLOWS
<all_urls> high Read and change everything on every website you open (pages, forms, passwords as you type them).
clipboardWrite medium Change what you copied: the trick clipboard hijackers use to swap a wallet address.
scripting medium Run its own code in pages it has access to.
tabs medium See the address and title of every open tab.
storage low Store its own data.The ID gives Chrome Web Store and Edge Add-ons links. The manifest is flagged with the wallet-drainer pattern: access to every website plus clipboard writing and script injection, the combination fake wallet extensions use to swap addresses.
FAQ
Where do I find an extension’s ID?
In Chrome or Edge open chrome://extensions (edge://extensions), turn on Developer mode and the ID appears under each extension. In Firefox open about:debugging, choose This Firefox, and read the Extension ID. The store URL works too.
Which permissions are dangerous?
Access to all websites, cookies, history, clipboard reading, debugger, native messaging, management and proxy can expose your accounts and wallets. Ask whether the extension really needs them for what it claims to do.
Does the tool contact the stores?
No. It only builds links to the store pages and reads the manifest you paste, inside your browser. The store sees the ID only if you open one of the links.