Is Text Editor safe?
We analyzed Text Editor version 5.0.1's actual code and gave it a 78/100 trust score. This is a generally purpose-aligned text-file opener with moderate…
Bottom line
This is a generally purpose-aligned text-file opener with moderate access and a notable network-validation weakness.
What it can access
It can read a user-selected HTTPS file and send it to the stated text editor, using broad optional HTTPS access only when needed.[Q1][Q3][Q6]
Security weaknesses
Public names resolving to private network addresses are not blocked, and the approved website can request nuisance tabs.[Q18][Q21]
Signs of misuse
There is no evidence of tracking, credential collection, page manipulation, or unrelated data sharing; its transfers support the text-editing feature.[Q6][Q12][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests context menus and storage, plus optional access to individual HTTPS sites. It has no automatic webpage page access or permanent all-sites access; the optional access directly supports downloading the link the user chose.
Declares contextMenus, storage, and optional https://*/* host access, with no content_scripts. — manifest.json:permissions and optional_host_permissions
Requests only the validated origin pattern for the selected link inside the user's click. — service-worker.js:requestHostAccessInGesture
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content scripts and requests no scripting permission. — manifest.json:top-level fields
Contains the packaged URL, permission, progress, ready, and error views. — open.html:document structure
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read the bytes, response metadata, hostname, and source URL of a public HTTPS file the user explicitly chooses. It cannot read page page, cookies, browsing history, bookmarks, or arbitrary local files.
Fetches and streams the validated source URL into an in-memory Blob. — open.js:downloadBounded
Declares no cookies, history, bookmarks, tabs, downloads, or content-script access. — manifest.json:permissions
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It temporarily stores at most 20 source-URL job records in session storage. Records expire after ten minutes and are deleted when claimed; downloaded file bytes remain only in the open extension tab's memory.
Stores a source URL and timestamp under a random job ID in chrome.storage.session, with TTL and count limits. — service-worker.js:writeOpenJob and pruneJobs
Reads and immediately removes the one-time job record. — open.js:claimJobFromFragment
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no capture or sensor permission. — manifest.json:permissions
Contains download and handoff logic without media or sensor APIs. — open.js:browser API review
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It downloads the chosen file from its source host, then sends the file Blob, sanitized filename, source URL, and timestamp to the exact texteditor.co child window. It sends no cookies or referrer and contains no analytics path.
Uses fetch with credentials omitted, no referrer, no cache, and redirects rejected. — open.js:downloadBounded
Posts the file metadata and Blob only after an exact-origin, exact-window, one-time-token HELLO. — open.js:handleHandoffMessage
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Restricts extension scripts to self and objects to none. — manifest.json:content_security_policy
Wraps downloaded bytes in a Blob and sends them by structured clone without executing or injecting them. — open.js:downloadAndHandoff and handleHandoffMessage
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Downloads start after a user context-menu choice or form submission. texteditor.co can also send a validated external open request that creates an extension tab without a new browser gesture, but any ungranted hostname still requires the user to click Allow.
Opens the workflow from explicit browser actions. — service-worker.js:contextMenus.onClicked and action.onClicked
Allows texteditor.co to create a validated open job and tab, while omitting a permission request because the external message carries no gesture. — service-worker.js:onMessageExternal and handleOpenRequest
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, search, privacy, management, downloads, webRequest, or declarativeNetRequest permission. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable routing, permission, external-message, and temporary-job logic with explicit security comments. — service-worker.js:entire file
Readable validation, bounded-download, and origin-pinned handoff implementation. — open.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All timers receive function callbacks and no text-to-code API appears. — *.js:dynamic-code review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no history, webNavigation, tabs, or automatic webpage access. — manifest.json:permissions and content_scripts
Uses the clicked linkUrl only for the requested open workflow. — service-worker.js:context-menu handler
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Creates a random job ID for a session-storage record that expires after ten minutes. — service-worker.js:writeOpenJob
Creates a fresh one-session handoff token for authenticating the child window. — open.js:mintToken
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Rejects URLs whose username or password component is non-empty. — url-policy.js:validateSourceUrl
Fetches with credentials: omit. — open.js:downloadBounded
Declares no cookies permission or page content script. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Provides a single extension-page URL input for the requested file. — open.html:urlForm
Requests no clipboard, capture, or sensor permission. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Treats the response as bounded Blob data and derives a filename/type from fixed packaged rules. — open.js:downloadBounded
Prevents remote scripts in extension pages. — manifest.json:content_security_policy
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Has no content script or traffic-modification permission. — manifest.json:top-level fields
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It performs a direct fetch of the chosen resource but does not intercept browser traffic. The policy blocks redirects, non-HTTPS URLs, local names, private literal IPs, credentials, and non-default ports; DNS rebinding remains outside its protection.
Applies scheme, hostname, address, credential, port, and length checks and strips fragments. — url-policy.js:validateSourceUrl
Uses redirect: error, credentials: omit, no-referrer, no-store, byte caps, and abort timers. — open.js:downloadBounded
Explicitly states that public DNS resolving to a private address is not prevented. — url-policy.js:file header
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:permissions
Rejects localhost, .local, IPv6 literals, and private/reserved IPv4 literals. — url-policy.js:LOCAL_HOSTNAMES, BLOCKED_IPV4_RANGES, and validateSourceUrl
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Encodes 32 random bytes as an unpadded URL-safe token used to authenticate one handoff. — open.js:mintToken
Keeps downloaded bytes as a Blob rather than evaluating them. — open.js:downloadAndHandoff
Can ordinary websites access privileged extension features through messaging or exposed files?
It deliberately accepts external messages from https://texteditor.co only. The site can check installation or request that a validated public HTTPS URL be opened; it cannot silently grant a new site permission, but repeated requests can create nuisance tabs.
Restricts external messaging to https://texteditor.co/*. — manifest.json:externally_connectable
Validates message version/type and URL, then creates a temporary job and extension tab. — service-worker.js:onMessageExternal and handleOpenRequest
Does not call permissions.request because an external message has no user gesture. — service-worker.js:handleOpenRequest comments and flow
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
All entry points are toolbar, link-menu, startup cleanup, or the documented texteditor.co protocol. — service-worker.js:event handlers
Branches on validation, permission, download, and handoff results. — open.js:beginOpen and state
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Uses bounded streaming, filename handling, random-token creation, and UI logic only. — *.js:computation review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines no content scripts and has no access to ordinary page DOM. — manifest.json:top-level fields
Contains a local form for the user to paste the direct file URL. — open.html:urlForm