Is Designer Tools safe?
We analyzed Designer Tools version 5.6.2's actual code and gave it a 76/100 trust score. Designer Tools is broadly purpose-aligned, but its page-URL…
Bottom line
Designer Tools is broadly purpose-aligned, but its page-URL analytics and account-linked tracking reduce privacy and trust.
What it can access
It can inspect and alter the active page after a click, read a chosen image, and send page URLs to its service; these powers fit design tools but can expose URL details. [Q1][Q2][Q5][Q6]
Security weaknesses
An embedded design page can send a message without its source being checked, potentially influencing saved overlay data. [Q21]
Signs of misuse
It sends full page addresses and account-linked usage data to its service for analytics, which may reveal sensitive URL details and enable persistent tracking. [Q6][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests activeTab and scripting to inject its packaged interface only after a toolbar click, storage for settings/account state, and webNavigation plus designer.tools host access for its login flow. Those permissions match the advertised design tools.
Declares designer.tools host access and scripting, activeTab, storage and webNavigation permissions. — manifest.json:12-31
The action click injects the fixed packaged app.js into that tab; webNavigation observes fixed designer.tools authentication-success URLs. — service_worker.js:14
Which websites can it run on, and can it read or change what appears on those pages?
Once the user clicks the extension button, the injected overlay can enumerate elements under the pointer, read computed styles, dimensions and accessibility structure, and add or remove its own page container, classes and CSS variables. The source shows no automatic injection into other pages.
chrome.action.onClicked is the reachable source for scripting.executeScript with packaged app.js. — service_worker.js:14
Uses document.elementsFromPoint, getComputedStyle, MutationObserver and an EXT_DT container to inspect the page and render the visible overlay. — app.js:353-394
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Page inspection is based on pointer selection, computed layout/styles and accessibility analysis; no password, change, input, submit or keylogging handler forwards field values. — app.js:353-394
The telemetry helper adds only event options plus location.href and location.hostname before messaging the worker. — app.js:54
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Permissions are limited to scripting, activeTab, storage and webNavigation. — manifest.json:12-23
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
The design-comparison feature reads an image that the user explicitly chooses and keeps the resulting overlay data in extension storage. No location, camera, microphone, clipboard, arbitrary-file or installed-app access was found.
The design modal's visible image-upload flow uses the selected File and saves it as the overlay image. — app.js:353
No geolocation, mediaCapture, clipboard, file-system or nativeMessaging permission is declared. — manifest.json:12-23
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A reachable telemetry path sends tool event names, event options, the active page's complete URL and hostname, extension version, and—when signed in—the Designer Tools user ID and name to https://designer.tools/services/usage. This is first-party product analytics rather than an unrelated recipient, but full URLs can expose sensitive paths or query values.
nr() adds window.location.href and window.location.hostname to every tracked tool event. — app.js:54
ux() adds stored user id/name and version; fx() POSTs the batch as text to https://designer.tools/api/usage every ten seconds. — service_worker.js:14
Authenticated API requests use the fixed https://designer.tools/api base and its stored bearer token. — service_worker.js:14
Does it download or run code, settings, or instructions supplied by a remote server?
The vendor server supplies account, subscription and Figma-import data that affects visible features. The package contains no path that interprets those responses as JavaScript or replaces packaged app.js; remote code execution is not demonstrated.
Fixed auth/refresh and account flows parse server data into token, user, tier and cancellation state. — service_worker.js:14
The Figma modal loads a fixed designer.tools iframe and consumes an imageBlob for the design overlay, not executable source. — app.js:353
The only page injection uses the literal packaged filename app.js. — service_worker.js:14
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After the user activates the tool, telemetry is queued automatically for opening, closing and using its controls and is uploaded every ten seconds. The initial page injection itself requires a clear toolbar click; login, upgrade, feedback and Figma operations require further visible actions.
The worker injects app.js only from chrome.action.onClicked and runs the usage-batch timer in the background. — service_worker.js:14
OPEN and subsequent named tool events call the telemetry helper with the page URL/domain. — app.js:54,394
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser override, proxy, search or privacy/settings permission is declared. — manifest.json:1-36
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
app.js and service_worker.js are production-minified bundles and include large recognizable libraries such as React, Konva, axe-core, CryptoJS and browser-polyfill. Minification makes review harder, but no encrypted first-party loader or concealed data was found.
Minified bundle retains library names, feature strings and readable first-party UI/data-flow constants. — app.js:1-394
Minified worker exposes fixed designer.tools endpoints, telemetry fields and action handlers directly. — service_worker.js:1-14
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains fixed Function('return this') and packaged library-generated function/template bodies. — app.js:353
Remote results are used as JSON account state or usage responses and the injected script is always packaged app.js. — service_worker.js:14
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Page code is injected only after the extension action is clicked. — service_worker.js:14
The tracking helper attaches location.href and location.hostname to events. — app.js:54
The worker batches those events to /api/usage. — service_worker.js:14
Does it create a persistent ID or browser fingerprint to recognize you?
Signed-in telemetry is tied to the persistent Designer Tools account ID and name stored in Chrome sync storage. The service also stores its bearer token and account/tier state there.
Usage events add stored user.id and user.name; authentication stores token, token_last_updated and user in storage.sync. — service_worker.js:14
The injected UI reads synced account and configuration state. — app.js:54
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends its own bearer token back to designer.tools for account refresh and sends full active-page URLs in first-party usage telemetry. It does not read cookies or send inspected page page, form values or passwords.
Zt() sends Authorization: Bearer only to the fixed designer.tools API base. — service_worker.js:14
Tracked data explicitly contains URL/domain and event options; no DOM-content field enters the message. — app.js:54
Does it record typing, form entries, clipboard contents, or screenshots?
It reads an image only when the user selects one for visual comparison. It observes pointer movement and page mutations for measurement overlays, but no path capturing typing, clipboard contents, form submissions or screenshots was found.
Visible design upload, pointer selection and MutationObserver flows support the overlay; telemetry calls identify actions but do not include the image or DOM contents. — app.js:353-394
No clipboardRead, tabCapture or desktopCapture permission is declared. — manifest.json:12-23
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Runtime message cases and API endpoints are fixed in the package, and executeScript names only app.js. — service_worker.js:14
No externally_connectable entry or broad command channel is declared. — manifest.json:1-36
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Page mutations are scoped to EXT_DT overlay containers, CSS variables/classes, rulers, grids and measurement controls. — app.js:353-394
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is requested. — manifest.json:12-23
Network calls are direct fixed-origin API and telemetry requests. — service_worker.js:14
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
The only host permission is https://designer.tools/ and nativeMessaging is absent. — manifest.json:12-31
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Action-click execution names fixed packaged app.js, with no downloaded source or decoded payload. — service_worker.js:14
CryptoJS and parsing utilities serve packaged libraries/state handling; no decode-to-eval path was found. — app.js:1-394
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
The mounted Figma modal registers window.addEventListener('message') and checks only whether data.imageBlob exists before saveImage; no origin/source comparison is present. — app.js:353
media/* and assets/* are declared web-accessible on all URLs, but the analyzed archive contains neither matching directory. — manifest.json:24-31
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Tier checks control named UI tools; SHA-256 of location.href associates visible grid/design settings with a page. — app.js:54,353
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The background worker handles auth, telemetry and action-click injection; no compute loop or mining endpoint exists. — service_worker.js:14
Canvas, axe-core and MutationObserver work supports the visible measurement/design/accessibility overlay. — app.js:353-394
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The reachable UI code creates/removes EXT_DT nodes and overlay styles; no form.action, submit interception or input-value assignment path was found. — app.js:353-394