Is HEX Color Picker safe?
We analyzed HEX Color Picker version 1.1.1's actual code and gave it a 76/100 trust score. This is a mostly purpose-aligned color picker with…
Bottom line
This is a mostly purpose-aligned color picker with unnecessarily broad website access and mildly intrusive lifecycle pages.
What it can access
It requests access across every website even though its color-picking feature does not need to read pages, making the scope broader than necessary [Q1].
Security weaknesses
The broad website scope and automatic page-opening behavior are unnecessary design choices, but no page modification or powerful browser control was found [Q1][Q8].
Signs of misuse
No misuse or sensitive-data collection was found, though installation opens a promotional page and removal opens a feedback page automatically [Q6][Q8].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests host access to every website, which is broader than its demonstrated color-picker feature needs. No packaged code uses that permission to read pages or make cross-origin requests.
Declares <all_urls> host access and all-site image resources, but no API permissions. — manifest.json:20-31
Feature code uses EyeDropper, localStorage and clipboard; it contains no page-injection or network client. — js/script.js:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines only a popup and background worker; no content_scripts or scripting permission. — manifest.json:14-31
Calls EyeDropper.open after the popup button click and consumes only sRGBHex. — js/script.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The EyeDropper result flows only into color conversion, recent-color storage and display. — js/script.js:1
No content script or page-injection permission exists. — manifest.json:14-31
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The permissions array is empty; only broad host access is declared. — manifest.json:27-31
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
After an explicit popup click, the browser EyeDropper lets the user choose one on-screen pixel and returns its color. Copy buttons write the displayed color to the clipboard only on another explicit click.
Button handlers call EyeDropper.open and navigator.clipboard.writeText; no screenshot bytes are captured. — js/script.js:1
Provides visible Pick Color and separate HEX/RGB/HSL copy controls. — popup.html:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No captured color or page data is uploaded. The background worker opens a fixed promotional page on installation and a fixed Google feedback form on uninstall, allowing those sites to observe the lifecycle visits.
Creates chrome-lib.tilda.ws/hex-color-picker on install and sets a forms.gle uninstall URL. — js/background.js:1
Contains no fetch, XHR, WebSocket or sendBeacon call. — js/script.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All color conversion, storage and UI behavior is packaged locally. — js/script.js:1
External URLs are opened as tabs/forms; their responses are not read as configuration. — js/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The color picker itself requires a user click. Separately, installing the extension automatically opens a fixed promotional page, and uninstalling opens a feedback form.
Registers automatic install and uninstall URL behavior. — js/background.js:1
EyeDropper and clipboard operations are attached to visible button clicks. — js/script.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings, proxy, search or management permission. — manifest.json:27-31
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The two small first-party scripts are minified into single lines, reducing readability, but their complete behavior and destinations remain straightforward. No encrypted data was found.
Single-line minified popup implementation remains directly inspectable. — js/script.js:1
Single-line lifecycle implementation exposes both external destinations. — js/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses setTimeout with an arrow-function callback; no text-to-code API appears. — js/script.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares broad host access but no tabs/history permission or content script. — manifest.json:29-31
Contains no current-tab query, URL read or telemetry. — js/script.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Reads/writes only the colors localStorage key and keeps at most 16 displayed values. — js/script.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission or API permissions. — manifest.json:27-31
Handles only colors, localStorage and explicit clipboard writes. — js/script.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers click handlers and calls clipboard.writeText; no keyboard listener or clipboard.read appears. — js/script.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Uses fixed external URLs only as navigation targets. — js/background.js:1
Contains all functional logic locally and no network client. — js/script.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Defines no website content script or scripting permission. — manifest.json:14-31
DOM operations target the popup's own labels, swatches and toast. — js/script.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads or proxy permission. — manifest.json:27-31
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Uses the browser EyeDropper API and receives one sRGBHex result. — js/script.js:1
Requests no nativeMessaging permission. — manifest.json:27-31
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads only the packaged ./js/script.js file. — popup.html:1
Loads the packaged js/background.js service worker. — manifest.json:17-19
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable or content_scripts declaration. — manifest.json:14-31
Registers only installation lifecycle handling, not messages. — js/background.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The only stored state is the local colors array. — js/script.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The worker only handles install/uninstall lifecycle URLs. — js/background.js:1
Popup computation is limited to color-format conversion and UI updates. — js/script.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or scripting permission can reach host-page forms. — manifest.json:14-31
Defines only isolated popup controls and fixed external rating links. — popup.html:1