Is Power Thesaurus safe?
We analyzed Power Thesaurus version 4.6.0's actual code and gave it a 68/100 trust score. Useful features justify some access, but access to every website…
Bottom line
Useful features justify some access, but access to every website and optional telemetry make this a moderately concerning extension despite no established abuse.
What it can access
The extension can read and change content across all websites for its selection-based thesaurus feature, and it can write to the clipboard. [Q2] [Q5] It sends selected search terms to its own service and may send limited analytics or diagnostic data elsewhere. [Q6]
Signs of misuse
The available evidence does not establish automatic collection of passwords, arbitrary form entries, browsing history, or unrelated website sessions. [Q3] [Q4] Searches and optional reporting are tied to lookup or enabled reporting events, with no demonstrated remote code execution, traffic tamIngb,
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension can operate across all websites and modify page content for its selection-based thesaurus features, while also writing to the clipboard and sending searches to its own service.
The extension requests access to all websites, scripting, activeTab, clipboardWrite, contextMenus, and storage, and injects content scripts across all URLs. — manifest.json:1
The stated purpose is to provide thesaurus lookups from selected text or browser controls on any page, which explains the page access but not its broad privacy impact. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: <all_urls> — manifest.json:1
Content scripts run directly on: *://*.powerthesaurus.org/*, <all_urls>, <all_urls>, <all_urls>, <all_urls> — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension reads text that you select or deliberately enter, so a sensitive message or form value could be sent if you select it. I found no complete path showing automatic reading of passwords, payment fields, or arbitrary form entries while you type.
The content-script UI receives selection-related state and listens for extension messages. — selection.3fa02834.js:530-555
The privacy text describes sending the entered or selected term, rather than automatically collecting all page input. — _locales/en/messages.json:462
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It does not request cookie, history, bookmarks, or downloads permissions, and no demonstrated runtime use of those APIs was found. Its own authentication data is stored in extension sync storage, which is separate from websites’ browser sessions.
Permissions contain scripting, activeTab, clipboardWrite, contextMenus, and storage, but not cookies, history, bookmarks, or downloads. — manifest.json:3
Authentication state is persisted using extension storage.sync. — auth.da3477cc.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests access outside ordinary web pages: clipboardWrite.
The manifest requests: clipboardWrite — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends entered or selected search terms to Power Thesaurus servers to obtain results, and it can send optional telemetry or error reports to Google Analytics and Sentry. These transmissions occur through extension code when the corresponding search, analytics, or reporting paths run.
The extension declares network destinations in its extension-page CSP, including Power Thesaurus, Google Analytics, and Sentry. — manifest.json:1-3
The bundled API client targets the Power Thesaurus GraphQL endpoint. — options.7d5be960.js:355
The extension states that entered or selected search terms are sent to fetch results. — _locales/en/messages.json:462
The service worker initializes Sentry and registers runtime handling; the candidate's cited analytics behavior is in this bundled runtime. — static/background/index.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
I found no demonstrated mechanism that downloads and executes remote JavaScript or remote instructions. It fetches API data and reports, but those responses appear to be consumed as application data rather than executed code.
No externally hosted scripts are declared; extension pages use self-hosted scripts. — manifest.json:3
The background bundle contains API/analytics handlers, not a demonstrated remote-code loader. — static/background/index.js:380
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension can open Power Thesaurus pages and send requests, but the inspected paths are tied to toolbar, context-menu, selection, or other extension actions. I found no evidence that it opens pages, redirects searches, downloads files, or sends arbitrary requests without a user-triggered or internal event.
The manifest declares a toolbar action and contextMenus permission. — manifest.json:1-3
The service worker contains the runtime and extension event handlers, but the cited behavior is event-driven. — static/background/index.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the extension ships very large generated bundles, often compressed into single lines, rather than readable source modules. This reduces auditability even though the files are present and loaded through manifest entry points.
The service worker is an approximately 870 KB generated bundle represented largely on one line. — static/background/index.js:1
The main content script is an approximately 2 MB generated bundle. — selection.3fa02834.js:1
The popup is an approximately 2 MB generated bundle. — popup.2f1b88b3.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
I found no demonstrated use of eval(), new Function(), or string-based timers in the extension’s own operational code. The manifest’s wasm-unsafe-eval setting does not itself prove that those JavaScript mechanisms are used.
The CSP mentions wasm-unsafe-eval, but this is a policy setting rather than evidence of JavaScript eval usage. — manifest.json:3
Reviewed bundled background code showed ordinary bundled modules and handlers, not a demonstrated string-to-code evaluator. — static/background/index.js:1-380
Does it track the websites, pages, searches, or links you visit?
It records and transmits searches when you deliberately enter or select a term for lookup, and it may send analytics identifiers or event metadata when analytics is enabled. I found no established collection of every website or page visited.
The extension states that entered or selected terms are sent for searches and says browsing history is not collected. — _locales/en/messages.json:462
The content script maintains selection-related state used by the lookup UI. — selection.3fa02834.js:530-555
The service worker initializes analytics/reporting-related runtime code. — static/background/index.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
The bundled code includes UUID generation and storage-related code, but the minified build does not establish that a persistent identifier is used to track you.
Includes crypto.randomUUID/UUID library code. — auth.da3477cc.js:1
Uses a UUID-like value in session-storage/lifetime handling, but the surrounding minified flow is difficult to trace. — static/background/index.js:380
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension stores authentication state and uses it to add an authorization header to Power Thesaurus API requests. I found no evidence that it reads arbitrary webpage cookies or sends page-session cookies elsewhere, but extension authentication data can be sent to the first-party API when authenticated requests run.
The API client targets the Power Thesaurus GraphQL endpoint and applies authorization state to requests. — options.7d5be960.js:355
The manifest grants host access and lists the first-party API as an allowed extension-page connection destination. — manifest.json:1-3
Does it record typing, form entries, clipboard contents, or screenshots?
The code visibly supports copying selected thesaurus results to the clipboard, but no evidence was found that it reads clipboard contents, records ordinary typing, or captures screenshots.
Requests clipboardWrite, not clipboardRead. — manifest.json:3
Calls copyToClipboard for extension-generated result text. — selection.3fa02834.js:405
Keyboard and input listeners are part of selection/UI interaction handling; no captured values are shown in the available result. — selection.3fa02834.js:555
Can a website or remote server send commands that make the extension take actions?
The service worker accepts only recognized internal message names, and the inspected manifest does not expose an externally connectable website-to-extension messaging interface. Content scripts can receive extension messages, but that alone does not show that an ordinary webpage or remote server can issue privileged commands.
The service worker dispatches messages only when the message has an object name included in an internal allowlist. — static/background/index.js:1
The content script listens for selection-related extension messages. — selection.3fa02834.js:530-555
No externally_connectable declaration is present in the supplied manifest. — manifest.json:1-3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No code evidence was found that alters referral codes, advertisements, shopping carts, links, or search results.
Declares selection/context-menu functionality and no webRequest or declarativeNetRequest permission. — manifest.json:3
Visible actions concern context menus, tabs, and selection UI rather than page monetization or search manipulation. — static/background/index.js:353
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence was found of traffic interception, header modification, download handling, or proxy-setting changes.
Permissions do not include webRequest, downloads, or proxy. — manifest.json:3
The visible background behavior uses tabs and messaging rather than traffic-control APIs. — static/background/index.js:353
Can it communicate with software on the computer or services running on localhost?
No native-messaging or localhost communication behavior was found. Occurrences of localhost are library/router defaults rather than demonstrated connections to local software.
No nativeMessaging permission is declared. — manifest.json:3
The localhost occurrence is in Sentry tracing-origin defaults. — options.7d5be960.js:22
The localhost occurrence is a router URL base. — options.7d5be960.js:407
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The package contains ordinary bundled JavaScript and declares wasm-unsafe-eval for extension pages, but I found no complete path that decodes or decrypts hidden data and then executes or injects it. The CSP permission alone does not establish hidden-payload behavior.
The extension-page CSP permits wasm-unsafe-eval, which is a capability setting rather than proof of decoded payload execution. — manifest.json:1-3
The service worker is bundled, but the supplied evidence does not establish a hidden-data decode-to-execution chain. — static/background/index.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
The extension runs isolated content scripts on webpages and exposes fonts and CSS resources, but those web-accessible files do not grant privileged extension APIs. I found no externally connectable interface or validated message path allowing ordinary websites to invoke privileged extension actions.
Content scripts match webpages, while web-accessible resources are fonts and CSS files; no externally_connectable declaration is present. — manifest.json:1-3
The content script listens for extension runtime messages, which is not equivalent to accepting messages directly from page JavaScript. — selection.3fa02834.js:530-555
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The code contains authentication, feature checks, analytics/error-reporting infrastructure, and selection-specific behavior, but the incomplete minified build does not permit a reliable determination of hidden user/site/date triggers.
Authentication and extension-related GraphQL configuration are present. — options.7d5be960.js:355
Feature/visibility checks appear around context-menu behavior, but their full conditions are not available. — static/background/index.js:353
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence was found of cryptocurrency mining, sustained hidden computation, or other concealed resource-intensive work.
The manifest defines ordinary selection, context-menu, storage, and clipboard functionality. — manifest.json:3
Visible background logic concerns messaging, tabs, and lifetime handling. — static/background/index.js:380
Does it change form fields or where a form sends its information?
The extension reads user-selected text and can copy replacement/result text, but the available source does not conclusively rule out form-field changes elsewhere in the large bundled scripts.
Copies extension-generated text to the clipboard. — selection.3fa02834.js:405
Handles input and selection events for the selection interface; the excerpt does not show form submission or field rewriting. — selection.3fa02834.js:555
The declared permissions and described feature focus on thesaurus selection rather than form modification. — manifest.json:3