Is Better Lyrics (Lyrics for YouTube Music) safe?
We analyzed Better Lyrics (Lyrics for YouTube Music) version 2.4.1's actual code and gave it a 62/100 trust score. The extension is useful and mostly…
Bottom line
The extension is useful and mostly purpose-aligned, but listening-data sharing and remotely updated themes reduce confidence.
What it can access
It can read and change YouTube Music pages, observe played songs, and send song details to lyric and translation services, which broadly fits its stated purpose.[Q1][Q2][Q6][Q12]
Security weaknesses
Installed themes are updated from remote sources without checking their promised integrity data, allowing changed styling to hide or imitate page controls.[Q7][Q16]
Signs of misuse
The extension sends song and video details for lyric lookups and can create a stable pseudonymous account identity, enabling listening-history tracking beyond the visible lyrics feature.[Q6][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Limits host and content-script access to music.youtube.com, requests storage/alarms, and makes downloads optional. — manifest.json:13-30, 78-152
Requests downloads only from the visible theme-export action and falls back to an anchor download if denied. — pages/standalone-editor.js:32
Which websites can it run on, and can it read or change what appears on those pages?
It can read and extensively modify YouTube Music only. Packaged main-world scripts observe its player and internal /next and /browse responses; the isolated script replaces the lyrics interface, adds controls, styles and picture-in-picture UI.
Runs seven isolated/main-world scripts only on music.youtube.com. — manifest.json:78-152
Wraps YouTube Music fetch for /youtubei/v1/next and /browse and forwards selected responses through document events. — content_scripts/content-1.js:70-97
Builds and updates the lyrics/player interface in the YouTube Music document. — content_scripts/content-0.js:37-41
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads player APIs and handles media controls, not page input fields. — content_scripts/content-2.js:72-91
Access is restricted to the music site and extension-owned pages. — manifest.json:78-152
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It does not use Chrome's cookies, history, bookmarks or downloads by default. Its main-world fetch wrapper can see YouTube Music request/response bodies and repeats localized /next requests with the user's existing YouTube credentials to YouTube itself.
Intercepts only music.youtube.com /next and /browse traffic and makes the English duplicate request to the same origin with credentials included. — content_scripts/content-1.js:70-97
No cookies, history or bookmarks permission exists; downloads is optional. — manifest.json:16-29
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A visible editor action can import one user-selected .css or .rics file and can export a theme through an optional download permission. No location, camera, microphone, arbitrary filesystem, installed-app or native-messaging access exists.
Creates a file picker accepting .css/.rics, reads the chosen file as text and requests downloads only for export. — pages/standalone-editor.js:32
Declares no device, media, filesystem or nativeMessaging permission. — manifest.json:16-30
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
For lyric lookup it sends the current video ID, song, artist, duration, album and any discovered ISRC to lyrics.services.dacubeking.com with a stored JWT. Optional translation/romanization sends lyric lines and language choices to Unison or Google Translate.
dG constructs the lyrics request from videoId, song, artist, rounded duration, album, ISRC and token, then POSTs to the Better Lyrics API. — content_scripts/content-0.js:40
Translation functions send lyric-line batches to Unison/Google endpoints when translation or romanization is requested. — content_scripts/content-0.js:1, 40
Theme marketplace fetches metadata/CSS from themes.betterlyrics.org, GitHub API and raw.githubusercontent.com. — background/service_worker.js:4
Does it download or run code, settings, or instructions supplied by a remote server?
It does not download JavaScript, but it does download styling instructions. After a user installs a marketplace or URL theme, the background checks every six hours for new remote CSS/RICS, stores it and automatically reapplies an updated active theme to YouTube Music.
tU/tD/tj fetch installed-theme CSS and tO schedules update checks every 360 minutes; tx resaves and reapplies the active theme. — background/service_worker.js:4
Compiles stored RICS into CSS and inserts it into a style element in YouTube Music. — content_scripts/content-0.js:19, 37-41
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Song-metadata requests happen automatically as tracks change because that is required to display lyrics. Installed-theme update checks run automatically every six hours.
Playback events trigger new metadata and lyrics loading when the video/song changes. — content_scripts/content-0.js:41
Creates a six-hour theme-update alarm and checks only themes already installed by the user. — background/service_worker.js:4
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no chrome_settings_overrides, proxy or browserSettings permission. — manifest.json:1-164
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package contains large minified Webpack/Extension.js bundles, duplicated settings/editor code and 22 locale files. Behavior remains identifiable through named constants, services and source-map comments.
Shows roughly 5.4 MB unpacked, dominated by UI/editor bundles and locale data. — inventory.json:1-260
Minified but semantically named lyric, translation, cache and theme modules remain traceable. — content_scripts/content-0.js:1-41
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
RICS parser implements its own expression/function interpreter and returns CSS under time, iteration, input and output limits. — content_scripts/content-0.js:6, 14, 19
Extension-page CSP allows scripts only from self and does not enable unsafe-eval. — manifest.json:31-32
Does it track the websites, pages, searches, or links you visit?
It can observe which songs play on YouTube Music and sends each lookup's song/video metadata to the lyrics service, so that service could build listening history. Local lyrics caches also reveal recently requested tracks until expiry or cache clearing.
Continuously emits current video ID, title, artist, duration and player state from YouTube Music. — content_scripts/content-2.js:72-91
Sends song metadata for lyrics and stores expiry-based blyrics_ cache entries locally. — content_scripts/content-0.js:19, 40-41
Does it create a persistent ID or browser fingerprint to recognize you?
Marketplace installation/rating or approved-site authentication can create a persistent P-256 key pair and key ID in local storage. The public key and signed, timestamped requests provide a stable pseudonymous identity to Better Lyrics services; the private key remains local.
Generates and stores userIdentity with an ECDSA private/public key, signs origin/nonce requests and retains approved origins. — background/service_worker.js:4
Signs theme install/rating operations and submits the public key when registration is required. — pages/marketplace.js:68, 90
Stores and reuses jwtToken for the lyrics API. — content_scripts/content-0.js:40
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Credentialed duplicate request remains on music.youtube.com and forwarded event data consists of parsed request/response objects inside the page. — content_scripts/content-1.js:83-97
Lyrics request explicitly constructs selected song fields and its own JWT rather than forwarding YouTube headers/cookies. — content_scripts/content-0.js:40
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Input/event handling is limited to lyrics controls, player state, fullscreen cursor behavior and extension UI. — content_scripts/content-0.js:40-41
No clipboard-read or capture permission is requested. — manifest.json:16-30
Can a website or remote server send commands that make the extension take actions?
A theme repository or Better Lyrics resolver can control CSS later injected into YouTube Music after the user installs that theme. This permits hiding, moving or visually spoofing page controls.
Resolver/lockfile integrity fields are propagated, but tU/tp/tl fetch and store CSS without hashing or comparing those fields. — background/service_worker.js:4
Compiles the stored remote text and assigns resulting CSS to a style element in the YouTube Music document. — content_scripts/content-0.js:19, 37-41
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Has no access to search engines, shopping sites or general pages. — manifest.json:13-30, 78-152
Network posts are limited to theme install counts, ratings and user rating retrieval. — pages/marketplace.js:68, 90
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Wrapper limits special handling to exact music.youtube.com /youtubei/v1/browse and /next prefixes. — content_scripts/content-1.js:83-97
No traffic-control permission exists and downloads is optional. — manifest.json:16-30
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares neither localhost hosts nor nativeMessaging. — manifest.json:13-30
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
Remote RICS/CSS may be compressed in storage, later decompressed and compiled into page CSS. This is the same conditional theme-update risk described in Q7/Q16, not a separate code-execution finding.
Compresses large theme CSS before local/sync storage after downloading it from a selected theme source. — background/service_worker.js:4
Decompresses customCSS, compiles RICS to CSS and passes the result to setTheme/style.textContent. — content_scripts/content-0.js:19, 37-41
Can ordinary websites access privileged extension features through messaging or exposed files?
Three declared Better Lyrics/Unison origins can request a signed identity response. The bridge verifies the actual sender against an exact allowlist, requires a nonce and matching claimed origin, normally opens a consent popup, and remembers approval for only 24 hours if selected.
onConnectExternal checks port name, sender.origin allowlist, message shape, nonce and origin equality before consent/signing. — background/service_worker.js:4
Shows the requesting host with Approve/Cancel and an optional remember checkbox. — pages/auth.js:1
Accepts same-window loader messages but resolves only packaged extension paths and rejects non-extension absolute schemes. — content_scripts/content-4.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Theme checks are periodic and conditional on installed themes rather than covert cohorts. — background/service_worker.js:4
External origins are statically declared. — manifest.json:20-25
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Resource-heavy paths are bounded theme compilation and visible lyric animation/rendering. — content_scripts/content-0.js:6, 19, 37-41
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Page commands are limited to seek, previous, play/pause and next player actions. — content_scripts/content-2.js:84-91
Theme content is applied as CSS through style.textContent, not form mutation code. — content_scripts/content-0.js:37-41