Is EverythingConvert — Quick File Converter safe?
We analyzed EverythingConvert — Quick File Converter version 1.0.0's actual code and gave it a 88/100 trust score. This appears to be a narrowly scoped,…
Bottom line
This appears to be a narrowly scoped, purpose-aligned converter launcher with no established abuse or major security weakness.
What it can access
It requests only context-menu access and sends a user-selected image or link address to its own converter site, fitting its stated purpose.[Q1][Q2][Q6]
Security weaknesses
It uses fixed packaged behavior, with no evidence of remote code, hidden execution, or website access to privileged features.[Q7][Q10][Q11][Q21]
Signs of misuse
No evidence shows tracking, sensitive-data collection, traffic manipulation, or actions beyond user-selected navigation.[Q12][Q14][Q17][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only context-menu access and declares no website access.
Declares a service worker and the contextMenus permission, with no host permissions or content scripts. — manifest.json:22-25
Which websites can it run on, and can it read or change what appears on those pages?
It receives only the image or link URL supplied by Chrome after the user chooses its context-menu action; it cannot inspect page content.
Uses info.srcUrl or info.linkUrl from a clicked context-menu item to construct the destination URL. — background.js:46-57
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content scripts or host permissions are declared. — manifest.json:22-25
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The only permission is contextMenus. — manifest.json:22-25
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Toolbar actions only construct a website URL and open it in a new tab. — popup.js:17-25
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A specifically right-clicked image or link URL is sent to everythingconvert.com as a src query parameter after the user chooses the conversion action.
Copies info.srcUrl or info.linkUrl into the EverythingConvert destination URL and opens it. — background.js:46-57
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All menu definitions, routes, and destination logic are packaged locally. — background.js:1-58
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It creates fixed context-menu entries on installation and otherwise acts only after a popup click or menu selection.
Registers menus on installation and opens a tab only from the onClicked handler. — background.js:25-57
Popup actions open a selected fixed tool page. — popup.js:24-62
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no setting-control permissions. — manifest.json:22-25
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains straightforward URL and context-menu logic. — background.js:1-58
Contains straightforward popup rendering and click handlers. — popup.js:1-62
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses only packaged static logic. — background.js:1-58
Uses only packaged static logic. — popup.js:1-62
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads info.srcUrl or info.linkUrl supplied for the selected context-menu target. — background.js:46-57
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Adds constant utm_source and action-specific utm_medium values to opened pages. — background.js:5-14
Adds constant extension and popup campaign labels. — popup.js:17-21
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies, identity, or host permissions. — manifest.json:22-25
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Search input only filters the packaged list of tool names. — popup.js:29-62
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
All destinations and behavior are packaged constants and handlers. — background.js:1-58
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, scripting permission, or host access. — manifest.json:22-25
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It opens EverythingConvert over HTTPS but does not intercept, proxy, or alter network traffic.
Builds HTTPS EverythingConvert URLs and opens them in tabs. — background.js:3-14,46-57
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests only contextMenus. — manifest.json:22-25
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains no fetch, XMLHttpRequest, import, or remote configuration logic. — background.js:1-58
Only opens fixed web destinations. — popup.js:1-62
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, externally_connectable entry, or web-accessible resources. — manifest.json:22-25
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The navigation handler runs after a context-menu click. — background.js:46-57
Tool navigation runs after a popup click or Enter keypress. — popup.js:24-62
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Only manages menus and destination URLs. — background.js:1-58
Only renders and filters a short tool list. — popup.js:1-62
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no page-access mechanism. — manifest.json:22-25