Is Backup WhatsApp Chats safe?
We analyzed Backup WhatsApp Chats version 4.0.0.3's actual code and gave it a 74/100 trust score. This is a purpose-aligned WhatsApp backup tool with…
Bottom line
This is a purpose-aligned WhatsApp backup tool with narrow site access, but its private-data reach and weak page bridge warrant caution.
What it can access
It can read private WhatsApp chats, contacts, and selected media on WhatsApp Web, which fits its backup purpose but remains sensitive access.[Q1][Q2][Q3]
Security weaknesses
WhatsApp page code can trigger local file saves and observe stored license information through a weakly validated bridge.[Q16][Q21]
Signs of misuse
No evidence shows chat uploads, browser-session theft, deceptive changes, or other misuse; licensing sends a key and limited device-recognition value to the vendor.[Q6][Q14][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It asks for storage and access only to WhatsApp Web. That scope is sensitive because it exposes private chats and contacts, but it is appropriately narrow for a WhatsApp backup tool.
Runs its content scripts only on https://web.whatsapp.com and requests only storage plus that host. — manifest.json:14-35
Which websites can it run on, and can it read or change what appears on those pages?
On WhatsApp Web it reads the active chat, messages, contacts, group participants, profile pictures, and optional media. This is the data needed to create the advertised backup.
Reads WhatsApp's internal chat, contact, message, media, and group-participant models and formats them for export. — js/injectedWA.js:1
Limits this page access to WhatsApp Web. — manifest.json:14-35
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read private WhatsApp messages, contact names, phone numbers, captions, and selected media. It does not monitor unrelated forms or passwords, and the traced access begins when the user starts an export.
Selects messages within the requested date range and extracts message bodies, senders, contacts, captions, and media. — js/injectedWA.js:1
The export path starts from the popup Download action after the user selects the range and format. — js/popup.js:34-104
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares storage and WhatsApp host access, but no cookies, history, bookmarks, or downloads permission. — manifest.json:30-35
Uses local extension storage for the cached license token and expiry. — js/checkLicense.js:16-24,55-60
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read a text file that the user explicitly selects for conversion and save ZIP, CSV, or text files locally. It has no camera, microphone, location, clipboard, native-messaging, or general file-system access.
Reads only a text file selected through the popup file picker. — js/popup.js:9-24
Builds and saves local ZIP, CSV, and text exports. — js/cs.js:173-223
Declares none of the camera, microphone, location, clipboard, or native-messaging permissions. — manifest.json:30-35
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
License checks send the entered license key, provider, product, and a browser-derived fingerprint to the vendor's fixed HTTPS licensing service. Chat contents are saved locally, and no path sending them to that service or another unrelated host was found.
Posts license data and the extension-ID/user-agent fingerprint to ext-license-tubes-projects-b4725834.vercel.app. — js/checkLicense.js:2-13,30-48
Packages chat exports and invokes local file saving rather than a network upload. — js/cs.js:173-223
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Treats the fixed service response as license status, token, and expiry only. — js/checkLicense.js:30-67
All service-worker and content-script code is packaged in the extension. — manifest.json:8-28
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Stores the chosen export options, validates the license, and starts the export from the Download button. — js/popup.js:34-104,191-196
Begins chat extraction when it receives the export-settings event created by the user-triggered popup flow. — js/injectedWA.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares none of the permissions needed for those browser-setting changes. — manifest.json:30-35
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The main WhatsApp extraction file is minified onto one long line, which makes review harder. Its data flow and the surrounding content, popup, and licensing code are still readable; deliberate concealment was not demonstrated.
Contains the core extraction and HTML-generation logic as a single minified line. — js/injectedWA.js:1
Provides readable code for injection, local packaging, messaging, and file output. — js/cs.js:1-245
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The packaged Lodash template implementation constructs a function from a template source string. — js/lodash.js:14866
The packaged archive library contains a Function constructor in a compatibility helper. — js/jszip.min.js:13
The reviewed feature code uses the libraries for data formatting and ZIP creation; no remote-text-to-Function path was found. — js/injectedWA.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Scopes the content script and host access to WhatsApp Web and declares no history permission. — manifest.json:14-35
Fetches WhatsApp-hosted profile pictures and message media for the local export. — js/injectedWA.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
For licensing, it creates a 32-character value from the extension ID and browser user agent and sends it with the license request. This is a limited device-recognition mechanism, not general browser fingerprinting or browsing tracking.
Base64-encodes the extension ID and navigator.userAgent, truncates the result, and sends it as fingerprint during license verification. — js/checkLicense.js:5-13,39-47
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends the extension's license key to its licensing service as expected. During an export, it also exposes the saved license key and cached license token to the WhatsApp page context; no WhatsApp cookies, session tokens, or login credentials were read or sent.
Sends the entered license and stores the returned license token and expiry. — js/checkLicense.js:30-60
Reads all extension-local storage and dispatches the serialized values into the page as a CustomEvent. — js/cs.js:229-243
Receives and parses that page event; no code reads WhatsApp cookies or login tokens. — js/injectedWA.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no clipboard or screenshot-related permission. — manifest.json:30-35
Reads WhatsApp message models rather than keyboard or form events. — js/injectedWA.js:1
Can a website or remote server send commands that make the extension take actions?
A script running in WhatsApp Web can send a page message that makes the extension save caller-supplied HTML, CSV, or text. The bridge checks that the message came from the same window but has no nonce or narrower sender validation; it does not expose general browser privileges.
Accepts FROM_PAGE, FROM_PAGE_CSV, and FROM_PAGE_TXT messages from window and saves the supplied content. — js/cs.js:204-226
Limits the receiving content script to WhatsApp Web. — manifest.json:14-35
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Injects three packaged scripts into WhatsApp Web. — js/cs.js:1-10
Uses the page context for chat extraction and progress UI, with no ad, affiliate, cart, or search-result rewriting path found. — js/injectedWA.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It creates local backup downloads after the user requests an export. A WhatsApp-page script can also trigger caller-supplied downloads through the page bridge, but no proxy changes, redirects, header rewriting, or unrelated traffic interception were found.
Creates ZIP, CSV, or text blobs and saves them locally; the same handlers accept matching page messages. — js/cs.js:173-226
Declares no proxy, webRequest, declarativeNetRequest, or downloads permission. — manifest.json:30-35
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission or localhost host access. — manifest.json:30-35
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Reads caption values from WhatsApp message objects and appends image/video/document captions directly to generated HTML, while separately escaping ordinary chat-message angle brackets. — js/injectedWA.js:1
Places the generated document string in a ZIP as an .html file without sanitizing it, then saves the archive locally. — js/cs.js:173-200
Can ordinary websites access privileged extension features through messaging or exposed files?
Scripts in WhatsApp Web can invoke the extension's local download bridge. When the user starts an export, page scripts can also observe a CustomEvent containing all extension-local settings, including the saved license key and token; this is limited to WhatsApp Web and does not expose WhatsApp credentials.
Accepts page messages for downloads and dispatches all local storage into a page-visible CustomEvent. — js/cs.js:204-243
Runs that bridge only on WhatsApp Web. — manifest.json:14-35
Shows that local storage can contain the cached license token and expiry. — js/checkLicense.js:16-24,55-60
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses the server response only to approve or reject the license. — js/checkLicense.js:30-101
Uses local user choices to configure and start the export. — js/popup.js:34-104
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The declared worker and content scripts support licensing and WhatsApp export; no mining component is declared. — manifest.json:8-35
The compute-intensive work is local media processing and archive generation for a requested backup. — js/injectedWA.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reads only the extension popup's selected text file, date range, and export options. — js/popup.js:9-24,34-104
Reads WhatsApp data models and generates exports; no form-action or input-rewriting path was found. — js/injectedWA.js:1