Is Transcribe WhatsApp Audio with AI - Audio to Text safe?
We analyzed Transcribe WhatsApp Audio with AI - Audio to Text version 2.8.2's actual code and gave it a 72/100 trust score. This is a purpose-aligned…
Bottom line
This is a purpose-aligned WhatsApp transcription extension with moderate privacy and security concerns.
What it can access
It runs only on WhatsApp Web and uploads voice messages for transcription, fitting its purpose but potentially exposing sensitive speech. [Q1] [Q2] [Q6]
Security weaknesses
WhatsApp page events can trigger audio retrieval and uploading without independent sender checks, though the bridge is site-limited and transcription-only. [Q16] [Q21]
Signs of misuse
No evidence shows unrelated tracking, credential theft, deceptive changes, remote control, or misuse beyond feature-related audio and account-data sharing. [Q7] [Q12] [Q14] [Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and tabs access and runs two scripts only on WhatsApp Web. That scope matches transcription and subscription handling, though tabs access lets the background observe all tab URL updates.
Limits content scripts to https://web.whatsapp.com/* and declares storage and tabs permissions. — manifest.json:22-39
Observes tab updates but only reacts when a completed URL matches one of two fixed Stripe checkout links. — service_worker.js:53-66
Which websites can it run on, and can it read or change what appears on those pages?
It reads WhatsApp's internal message collection, retrieves voice-message audio and adds transcript and subscription controls to WhatsApp's page. It does not read ordinary message text.
Accesses WhatsApp's internal message and media modules and requests downloads for newly added audio messages. — page.js:4-27
Watches the WhatsApp message DOM, identifies rendered audio controls and adds transcription UI to their message containers. — content.js:658-680
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Voice messages can contain passwords, financial details or other sensitive speech. The extension processes the audio itself, but does not read typed inputs, password fields or payment forms.
Resolves the selected WhatsApp audio message to its in-memory media blob URL. — page.js:51-67
Reads that audio blob and sends it as audio.ogg to the transcription backend. — service_worker.js:108-121
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares only storage and tabs permissions. — manifest.json:35
Maintains a 20-day transcript and audio-hash cache in extension storage. — service_worker.js:11-40
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Obtains audio through WhatsApp's internal media blob cache. — page.js:4-7
Declares no device, capture, file or native-messaging permissions. — manifest.json:35
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Audio and the selected language go to the developer's fixed Cloudflare Workers transcription service. Business phone numbers go to its subscription services and appear as Stripe checkout reference IDs.
Sends the business phone in x-phone to /auth and audio.ogg plus an optional language to /transcribe at the fixed developer backend. — service_worker.js:1, 79-83, 108-121
Builds fixed Stripe checkout links with the WhatsApp phone number as client_reference_id. — content.js:187-213
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Treats /auth as a boolean subscription check. — service_worker.js:79-104
Reads the /transcribe response as text and returns it to the WhatsApp content script. — service_worker.js:154-155, 201-204
Places returned transcript text into a new element with innerText, preventing it from becoming HTML or script. — content.js:532-536
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
For free personal users and subscribed business users, each rendered voice message is automatically queued and uploaded without a per-message click. Installation and the advertised instant-transcription purpose provide broad consent, but the package UI does not show an upload confirmation.
Immediately dispatches getOrCreateURL when an uncached audio message receives transcription UI and the account is enabled. — content.js:142-169
Enables all personal accounts, observes rendered WhatsApp messages and automatically adds the audio transcription flow. — content.js:635-680
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings, search, proxy, privacy or request-modification permissions. — manifest.json:35
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Lists only three small JavaScript files totaling about 45 KB plus localization and image assets. — inventory.json:1
Background behavior is presented as readable, structured source with explanatory comments. — service_worker.js:1-215
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All three JavaScript files were checked for dynamic-code primitives. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Runs page code only on WhatsApp Web. — manifest.json:22-31
Checks completed tab URLs only against two hard-coded Stripe payment links. — service_worker.js:53-66
Does it create a persistent ID or browser fingerprint to recognize you?
For WhatsApp Business accounts, it reads the account phone number, sends it to the developer for subscription status and uses it as Stripe's customer reference. Personal accounts skip the subscription request.
Reads the logged-in WhatsApp account type and phone number from WhatsApp's connection model. — page.js:14-18
Sends the number for subscription checking only when the account is Business. — content.js:639-655
Places the phone number in the x-phone header to the developer's /auth endpoint. — service_worker.js:79-83
Does it send cookies, session details, authentication data, or page contents elsewhere?
A complete active path sends WhatsApp voice-message audio to the developer's transcription server: the page resolves the message blob, the page access forwards it, and the service worker uploads it. Text chats, cookies and WhatsApp credentials are not part of that path.
Accepts a message ID, retrieves its WhatsApp media blob URL and emits the URL and file hash. — page.js:51-67
Parses that event and forwards the message ID, blob URL and hash to the extension background. — content.js:44-47
Fetches the supplied blob, names it audio.ogg and posts it to the fixed /transcribe endpoint. — service_worker.js:108-121
Does it record typing, form entries, clipboard contents, or screenshots?
It reads WhatsApp voice audio and can copy a returned transcript to the clipboard after a click. It does not monitor typing, read clipboard contents, capture screenshots or record the microphone or screen.
Reads and uploads the selected WhatsApp audio blob. — service_worker.js:108-121
Writes transcript text to the clipboard only when the user presses the copy button. — content.js:300-310
Can a website or remote server send commands that make the extension take actions?
WhatsApp page code can request a message type or media blob through custom events, and the isolated script can ask the background to upload it. The bridge is restricted to WhatsApp Web and the operation is limited to transcription, but event senders are not independently authenticated.
Listens for page custom events containing message IDs and returns their type or in-memory audio URL. — page.js:30-45, 51-102
Trusts matching window custom events and forwards returned media details to the extension runtime. — content.js:44-83
Limits both bridge components to https://web.whatsapp.com/*. — manifest.json:22-31
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds a More button beside transcript output with two labeled Chrome Web Store links. — content.js:315-444
Shows a dismissible rating request after every 15 completed transcriptions until rated. — content.js:541-632
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads or proxy permission. — manifest.json:35
Contains the package's only network requests: fixed auth/transcription endpoints and the WhatsApp-provided media blob URL. — service_worker.js:79-121
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or local-service permissions. — manifest.json:35
Uses only the fixed HTTPS backend and WhatsApp media blob URLs. — service_worker.js:1-215
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches an audio blob and appends it directly to FormData without decoding executable content. — service_worker.js:108-121
Can ordinary websites access privileged extension features through messaging or exposed files?
The WhatsApp Web page can reach a narrow privileged bridge that resolves internal audio objects and can lead to an upload. Other websites cannot access it, and no general extension services or arbitrary destination is exposed.
Exposes message-type and media-URL operations through page-visible custom events. — page.js:30-102
Installs the bridge only on WhatsApp Web. — manifest.json:22-31
Always sends resulting audio to the one hard-coded transcription endpoint. — service_worker.js:108-121
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior depends only on account subscription status, cached results and visible WhatsApp audio messages. — service_worker.js:1-215
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Uploads audio for remote processing rather than performing a local compute-heavy transcription. — service_worker.js:108-121
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates its own overlay and transcript elements without selecting or modifying page forms or inputs. — content.js:86-129, 142-238, 276-539