Is Free VPN For Chrome & Ad blocker — Planet VPN safe?
We analyzed Free VPN For Chrome & Ad blocker — Planet VPN version 3.8.1's actual code and gave it a 62/100 trust score. This is a powerful but…
Bottom line
This is a powerful but purpose-aligned VPN with meaningful privacy and remote-control concerns, especially analytics collection and server-chosen advertising.
What it can access
It can route all browser traffic, inspect history and tabs, change privacy settings, and manage other extensions; these fit the advertised VPN tools but create broad access. [Q1][Q4][Q9][Q18]
Security weaknesses
Remote services choose proxy settings, alternate service domains, and advertising destinations, so a compromised service could misuse browser traffic or send users to harmful sites. [Q7][Q16][Q22]
Signs of misuse
The extension sends persistent IDs, country, and account email to Google Analytics and opens server-selected advertising pages, which exceeds the core VPN function. [Q6][Q13][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests proxy control, all-site hosts, history, tabs, webRequest, request blocking, privacy settings, management, scripting and unlimited storage. This is powerful but mostly consistent with a VPN, ad blocker, tracker blocker and local history-cleaning feature.
Declares proxy, history, webRequest, declarativeNetRequest, tabs, privacy, management, scripting and related permissions. — manifest.json:20-38
Declares <all_urls> host access. — manifest.json:18
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Limits the declared pin-modal content script to freevpnplanet.com, planetvpnarab.com and freevpnplanet.net. — manifest.json:80-102
Uses packaged ad-block CSS selectors to hide matched elements without serializing page content. — background.js:5
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension popup accepts account email/password and support messages and sends them to Planet VPN's own services. This is normal authentication/support behavior; no page password capture or unintended recipient was found.
Posts popup login input to Planet VPN /login and support name, email and message to /v2/user/support/ticket. — background.js:1
Implements the visible sign-in and support forms within the extension popup. — popup.js:75-77
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It receives browser-history visit events, reads active tab URLs/domains and inventories enabled extensions with proxy permission. History URLs are used for an optional local deletion feature, and extension inventory is used for a visible VPN-conflict warning.
Registers history.onVisited and deletes the visited URL when the user enables the do-not-save-history setting. — background.js:5
Calls management.getAll and filters enabled extensions that also request proxy permission. — popup.js:75
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does not request clipboard, geolocation, downloads, nativeMessaging, camera or microphone permissions. — manifest.json:20-38
Determines country through api.geoplace.info or the browser timezone. — background.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Planet VPN receives login/support data, IP-derived location and VPN configuration requests. Google Analytics receives interaction events containing a persistent client ID, country and the signed-in account email.
Builds GA4 event parameters with user_email, geo, browser, OS, language, user type and screen, then posts them to google-analytics.com/mp/collect. — background.js:1
Uses Planet VPN APIs for login, profile, connection configuration, offers, support and ads. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The backend supplies proxy services, feature/service popups, alternate services domains and advertising URLs. Free-user ad responses can cause a supplied URL to open in a new foreground or background tab, with daily and timing limits.
Fetches encrypted server configurations, service popups and ad records from Planet VPN-controlled endpoints. — background.js:1
createAdsTab selects a backend-supplied link and opens it with tabs.create/update while enforcing ads_per_day and ads_interval. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On startup it restores proxy state, blocking rules and enabled privacy settings. Advertising is triggered by free-user connect/server-selection actions rather than silent general browsing, although the resulting ad tab may open in the background.
Initializes saved connection and privacy/blocking settings on startup and installation. — background.js:5
Calls createAdsTab before a free user connects or selects a server. — popup.js:7
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It sets and clears Chrome's regular proxy and can enable Do Not Track, reject third-party cookies and delete visited URLs. These controls are advertised and exposed as user settings.
Sets fixed_servers proxy with a selected server and bypass list, then clears it on disconnect. — background.js:5
Changes third-party cookie and Do Not Track privacy settings only when their toggles are enabled. — background.js:5
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The background and popup are large minified bundles, and several large packaged rule lists make review harder. The important proxy, ads, analytics and settings flows remained traceable; minification alone is not evidence of abuse.
Minified service-worker bundle combines VPN, ads, analytics, Firebase and blocking logic. — background.js:1-5
Minified UI bundle contains the consent, connection, ad and conflict-management flows. — popup.js:1-77
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Stores an ad response's script string alongside link/image metadata but has no execution sink for it. — background.js:1-5
The ad modal consumes link, image, text and timer only; it does not consume script. — popup.js:7
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Stores the current tab/domain and handles history.onVisited by locally deleting e.url when historyStatus is enabled. — background.js:5
Analytics payload construction includes screen, event, email, country and device fields but no current URL or history field. — background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates persistent analytics and visitor UUIDs and sends interaction events with account email and country to Google Analytics. The required Chrome consent screen discloses technical data, personal data and ads, but describes email/name as needed for account, purchase or support rather than analytics.
Creates analytics.clientId and visitorId values and sends client_id plus user_email and geo in GA4 events. — background.js:1
Consent UI says email/name are collected for account, subscription or support and that free users receive ads. — popup.js:75
Does it send cookies, session details, authentication data, or page contents elsewhere?
Account credentials are sent to Planet VPN's login services and the returned bearer token is used for its services. Vendor-supplied proxy credentials are used only to answer proxy authentication challenges.
Posts login data to Planet VPN /login and attaches the session bearer token to authenticated Planet VPN API calls. — background.js:1
Answers proxy onAuthRequired events with credentials from the selected Planet VPN server configuration. — background.js:5
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Does not inject a general all-site form or input content script. — manifest.json:80-102
Password, email and support inputs belong to the extension's own visible account/support UI. — popup.js:75-77
Can a website or remote server send commands that make the extension take actions?
Planet VPN servers choose proxy connection details, service-blocking notices and free-tier ad destinations. The ad destination can be opened as a browser tab, but this occurs when the user presses connect or selects a server and is rate-limited.
Processes remote proxy configs, service popup flags and ads, including foreground/background tab selection. — background.js:1
Invokes createAdsTab during connect and server-selection actions before continuing the VPN flow. — popup.js:7
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It hides ad elements with packaged CSS, opens advertising tabs for free users and can disable conflicting VPN extensions after the user confirms a visible dialog. No form-action rewrite, search hijack or hidden page-content replacement was found.
Injects packaged ad-block CSS selectors and manages request-blocking rules. — background.js:5
Lists conflicting proxy extensions in a modal and calls management.setEnabled(false) only from its disable action. — popup.js:75
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It routes browser traffic through a selected fixed proxy, supplies proxy authentication and blocks ads/trackers through declarative rules. Those are core advertised features.
Sets fixed_servers proxy, registers onAuthRequired, and clears the proxy on disconnect. — background.js:5
Enables packaged declarativeNetRequest ad/tracker rules and user-defined allow exceptions. — background.js:5
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does not request nativeMessaging or system-application access. — manifest.json:20-38
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Sets extension_pages CSP to script-src 'self'; frame-src is limited to two ad hosts. — manifest.json:103-105
Displays remote ad images/approved iframes and opens links without treating response fields as JavaScript. — popup.js:7
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Restricts externally_connectable to localhost and freevpnplanet.com origins. — manifest.json:73-79
Sends only an internal CHECK_PINNED message and toggles a vendor-page prompt from the response. — content/pin-modal/script.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior depends on account tier, server configuration, remote service popups, backend-domain selection and ad campaigns. A compromised vendor backend could redirect free users to harmful ad destinations or supply hostile proxy services, though it still could not execute JavaScript inside the extension through the paths reviewed.
Fetches tier-specific server configs, service popup state, alternate API domains and ad campaign records. — background.js:1
Validates alternate API domains only by requesting the candidate and checking for service: ok. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background activity is VPN connection management, request blocking, ads, analytics, Firebase and settings. — background.js:1-5
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The limited vendor-site content script only shows or hides its pin prompt. — content/pin-modal/script.js:1
Account and support forms are internal extension UI and use fixed Planet VPN API routes. — popup.js:75-77