Is Text Editor safe?
We analyzed Text Editor version 2.1.0's actual code and gave it a 80/100 trust score. Text Editor is mostly purpose-aligned, but broad bookmark access and…
Bottom line
Text Editor is mostly purpose-aligned, but broad bookmark access and optional account-related data create moderate privacy exposure.
What it can access
The extension can read and change bookmarks, store data, and use optional Google sign-in for its note and account features. [Q1] It receives selected webpage text and user-chosen files, but has no general website access or arbitrary file browsing. [Q2] [Q5]
Security weaknesses
No meaningful security weakness is established: ordinary websites cannot reach privileged features, and remote responses only control billing displays or user-clicked navigation. [Q16] [Q21] Broad bookmark access is the main design concern, but active use is limited to note folders. [Q4]
Signs of misuse
No evidence shows browsing surveillance, search manipulation, hidden work, or collection of note and imported-file contents. [Q12] [Q17] The service receives sign-in and billing/support information through stated account features, including a persistent service identifier. [Q6] [Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests bookmarks, storage, context menus and Google identity/email access. Bookmarks are broad, but the active code uses them as its note database; identity is used only during explicit sign-in.
Declares contextMenus, bookmarks, storage, identity and identity.email with openid/email/profile OAuth scopes. — manifest.json:26-44
Creates/searches TextEditor and deletedNotes bookmark folders and starts Google auth only for the googleAuth message. — background.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It has no page access and cannot freely read or change websites. Chrome supplies selected page text only when the user invokes the extension's visible selection context menu; that text is appended to the chosen note.
Contains no content_scripts, scripting permission or host permissions. — manifest.json:1-48
Creates context menus limited to the selection context and uses clickInfo.selectionText only after that user action. — background.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No website execution capability is declared. — manifest.json:1-48
Editor key/command handlers save only TinyMCE content inside the extension page. — js/view.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The bookmarks permission technically exposes all bookmarks. Active code searches named TextEditor folders and reads, creates, updates, moves and deletes entries there to implement notes and trash.
launchNotes searches TextEditor/deletedNotes, reads their subtrees and builds note context menus. — background.js:1
Saves note HTML in bookmark URLs and moves note bookmarks between active/trash folders. — js/view.js:1
Does not request cookies, history or downloads. — manifest.json:26-32
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
User-initiated import can read a chosen text/DOCX file or image through file inputs and FileReader, then place its contents in the note. It does not browse arbitrary files or use location, camera, microphone, clipboard or native messaging.
File-input change handlers read only the selected file; DOCX uses packaged Mammoth and images are resized into data URLs. — js/view.js:1
No file-system, geolocation, media, clipboard or nativeMessaging permission is declared. — manifest.json:26-32
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
services.text-editor.net receives explicit authentication data, email sign-in requests, bearer session tokens, a random billing/support user ID, selected price IDs and user-entered support subject/message. No note body, selected webpage text or imported file content is included in any services request.
POSTs only the Google access_token to /auth/google and stores the returned session token/email. — background.js:1
API calls cover auth, status, prices, checkout, portal, signout and user-submitted support fields. — js/paywall-gate.js:1
Note saves write content to a data:text/plain bookmark URL, not fetch. — js/view.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The backend supplies prices, subscription status and checkout/billing portal URLs. These responses control billing UI and user-clicked navigation, not extension JavaScript or note behavior; the extension page CSP allows scripts only from the package.
Parses JSON prices/status and opens checkoutUrl or portal url after user actions. — js/paywall-gate.js:1
CSP is script-src 'self' with connect-src limited to api.text-editor.net. — manifest.json:36-38
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Installation automatically opens the product welcome page and sets a feedback URL for uninstall. Note capture, file import, login, billing, support, deletion and export otherwise require clear user actions.
onInstalled opens https://text-editor.net/welcome only for a new install and registers a Google Forms uninstall URL. — background.js:1
Sensitive note/file operations are bound to editor, context-menu or visible button actions. — js/view.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser override, proxy, search or privacy/settings capability. — manifest.json:1-48
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Identifies the packaged editor library and license. — tinymce/LICENSE.TXT:1-20
Packaged browser DOCX conversion bundle with module names and static implementation. — lib/mammoth.browser.min.js:1
First-party service-worker behavior remains directly inspectable despite minification. — background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses window when present; only the fallback evaluates the fixed literal return this. — tinymce/js/tinymce/tinymce.min.js:1
Bluebird/Underscore internals generate library templates/property accessors; imported DOCX data is parsed separately into document nodes/HTML. — lib/mammoth.browser.min.js:1
Extension CSP does not enable unsafe-eval. — manifest.json:36-38
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs or history permission is requested. — manifest.json:26-32
Selection menu handler uses selectionText and does not store pageUrl or linkUrl. — background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
For billing and support it creates a persistent random user/visitor ID in Chrome sync storage and sends it to the Text Editor backend. Account email and bearer session token are also stored in sync storage for cross-device availability.
m() loads or creates user_id/pw-801-visitor-id and checkout, portal and support requests send ext_user_id. — js/paywall-gate.js:1
Stores returned user_token and user_email with chrome.storage.sync after Google auth. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
After the user chooses Google sign-in, the extension sends the resulting Google OAuth access token to services.text-editor.net/auth/google to exchange it for a Text Editor session. Later services calls send that service's bearer token back to the same backend.
Interactive launchWebAuthFlow obtains access_token and POSTs it only to api.text-editor.net/auth/google. — background.js:1
Authenticated API helper adds Authorization: Bearer user_token only to the fixed api.text-editor.net base URL. — js/paywall-gate.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
Chrome provides selected webpage text only when the user invokes the extension's selection context menu, and that text is saved to a note. It does not monitor typing, clipboard changes, forms or screenshots.
Context menus use contexts:['selection']; onClicked appends clickInfo.selectionText to the chosen note. — background.js:1
No clipboard, tabCapture or website script permission is declared. — manifest.json:26-32
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
All API endpoints and response uses are fixed in packaged code. — js/paywall-gate.js:1
No externally_connectable declaration exists. — manifest.json:1-48
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
TinyMCE link action edits note content; note-link clicks call chrome.tabs.create without modifying any webpage. — js/view.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is requested. — manifest.json:26-32
Text, HTML and Word exports are local Blob/data URL downloads initiated by user clicks. — js/actions.js:1-25
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Network CSP names only api.text-editor.net and no nativeMessaging permission is present. — manifest.json:26-48
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
FileReader and Mammoth convert selected files to TinyMCE content; note bookmarks are decodeURIComponent'd and passed to setContent. — js/view.js:1
Extension-page CSP restricts scripts to the installed package. — manifest.json:36-38
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable, content_scripts or web_accessible_resources declaration exists. — manifest.json:1-48
Internal onMessage handles model/config/note state and explicit googleAuth actions. — background.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Account and subscription checks gate visible premium UI/exports; permissions and data flows remain static. — js/paywall-gate.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Local file conversion and canvas resizing are bound to selected-file handlers. — js/view.js:1
Export work starts from visible print/download buttons. — js/actions.js:1-25
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script, scripting permission or site access is declared. — manifest.json:1-48