Is Grammar Checker (Offline) safe?
We analyzed Grammar Checker (Offline) version 0.1.2's actual code and gave it a 86/100 trust score. This appears to be a narrowly scoped offline grammar…
Bottom line
This appears to be a narrowly scoped offline grammar tool with modest privacy and automatic-page-opening concerns.
What it can access
It requests only local storage and context-menu access, but saves any text deliberately entered into its own editor, which could include sensitive writing [Q1][Q3].
Security weaknesses
It automatically opens its homepage after installation and some updates, an unnecessary but limited design choice [Q8].
Signs of misuse
No evidence shows website tracking, collection of browser-session data, or manipulation of pages; text stays with local checking components [Q12][Q14][Q17].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Declares only storage and contextMenus, an action and a background worker; no host_permissions or content_scripts are present. — manifest.json:4-35
Uses the context menu only on the extension action to select its own editor presentation. — lib/common.js:8-38
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content script or website host access. — manifest.json:4-35
Provides the private extension textarea, suggestion panel and packaged index.js UI. — data/interface/index.html:1-107
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It receives whatever the user deliberately types or pastes into its own editor, which could include sensitive prose. The complete draft is saved in local extension storage and passed to local grammar engines.
Stores the editor value as usertext and passes it to the packaged Harper linter or optional browser Proofreader API. — data/interface/index.js:426-460
No host permission or content script permits collection from other pages. — manifest.json:4-35
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Permission list contains only storage and contextMenus. — manifest.json:16-20
Defines only local welcome timestamp, editor size and presentation settings. — lib/config.js:1-20
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
The user can explicitly drop a local text/plain file into the extension editor, which reads that one file with FileReader. It does not browse the file system or access location, camera, microphone, installed applications or native messaging.
Reads only the first user-dropped text/plain file after a drop into the editor. — data/interface/index.js:138-163
Writes the editor text to the clipboard only from the visible Copy button handler. — data/interface/index.js:120-124
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No user text is sent anywhere. The only confirmed external navigation is mybrowseraddon.com on install, occasional update, uninstall, support or donation clicks; automatic URLs include extension version and install/update reason.
Registers the homepage as uninstall URL and opens it on install or updates separated by more than 45 days, adding version and reason parameters. — lib/runtime.js:4-21
Support/donation buttons open the homepage, while model download is requested through the browser Proofreader API. — data/interface/index.js:104-116, 575-612
Routes editor text only to local Harper or Proofreader objects; no fetch/XHR call is made. — data/interface/index.js:426-460
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Dynamically imports harper.js from chrome.runtime.getURL, a packaged extension URL. — data/interface/index.js:284-285
Embeds the grammar engine WASM as a data URL and initializes that packaged payload. — data/interface/vendor/harper.js:1354, 1623
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically opens its declared homepage on first install and on some updates more than 45 days apart, and stores drafts while the user types. The homepage action is normal extension promotion/update behavior, though not necessary for offline checking.
Opens the homepage automatically on install and qualified updates. — lib/runtime.js:4-21
Persists the current draft locally when its own editor receives input. — data/interface/index.js:426-428
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Permission list omits browser-setting and traffic-control APIs. — manifest.json:16-20
Generic tab helper creates or focuses a supplied editor/homepage URL; it does not alter browser defaults. — lib/chrome.js:128-175
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Almost all package size is the readable Harper.js distribution with an inlined Base64 WebAssembly grammar engine and duplicated worker source. This makes the package large but the wrapper logic and data flow remain straightforward.
Shows a roughly 14.9 MB unpacked package, of which harper.js is about 14.8 MB. — inventory.json:1-90
Contains the shipped Harper library, inlined WASM and worker wrapper in recognizable generated code. — data/interface/vendor/harper.js:1-1958
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Imports the fixed packaged harper.js URL. — data/interface/index.js:284-285
Creates a module worker from the library's fixed jsContent constant rather than evaluating grammar input or server text. — data/interface/vendor/harper.js:1771-1795
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No host permissions, content scripts or history permission are declared. — manifest.json:4-35
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Lists the small set of locally stored background settings. — lib/config.js:1-20
Stores UI settings and usertext locally without generating an identifier. — data/interface/index.js:66-91, 426-428
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Stores text as usertext and passes it to local linter/proofreader objects; there is no network call. — data/interface/index.js:426-460
No cookie or website permission provides another sensitive input source. — manifest.json:4-35
Does it record typing, form entries, clipboard contents, or screenshots?
It reads typing in its own dedicated textarea and saves the draft locally so the editor can restore it. It cannot monitor typing on other sites.
Defines the extension's own text-entry area. — data/interface/index.html:11-17
Handles only its own textarea input and explicit clipboard-write button. — data/interface/index.js:120-124, 317-336, 426-460
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no page injection or external communication entry point. — manifest.json:4-35
Loads the packaged Harper engine and optional built-in browser model rather than remote rules or commands. — data/interface/index.js:284-305
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Visible support and donation controls open homepage URLs on user click. — data/interface/index.js:104-116
No page access allows link or commerce manipulation. — manifest.json:4-35
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests only storage and contextMenus. — manifest.json:16-20
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or localhost host access. — manifest.json:4-35
Initializes only packaged Harper and the browser-provided Proofreader object. — data/interface/index.js:284-305
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
Harper ships its WebAssembly as an inlined Base64 data URL and builds a worker from a fixed packaged JavaScript string. Those bytes and source are present in the signed package and always implement the same local grammar engine.
Defines and instantiates the packaged Base64 WASM module. — data/interface/vendor/harper.js:1354, 1623
Wraps the packaged jsContent constant in a Blob/data URL to start the grammar worker. — data/interface/vendor/harper.js:1771-1795
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no web_accessible_resources or externally_connectable entry. — manifest.json:4-35
Internal runtime message/port dispatcher services extension interface ports only. — lib/runtime.js:24-117
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses a 45-day update-page interval, not selective security-sensitive behavior. — lib/runtime.js:4-21
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runs grammar checking after user editor input and invokes the packaged linter for that text. — data/interface/index.js:317-336, 426-456
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Accepted suggestions update the extension-owned userarea and userinput elements. — data/interface/index.js:385-420
No host permission or content script permits form editing on websites. — manifest.json:4-35