Is Online File Converter safe?
We analyzed Online File Converter version 1.0.1's actual code and gave it a 96/100 trust score. This is a narrowly scoped converter-link extension with no…
Bottom line
This is a narrowly scoped converter-link extension with no evidence of misuse or meaningful security weaknesses.
What it can access
It requests no browser permissions; its popup opens fixed converter websites after a click, which fits its stated purpose. [Q1][Q18]
Security weaknesses
No meaningful security weakness was found: it has no remote command channel, exposed privileged features, or dynamic code execution. [Q16][Q21][Q11]
Signs of misuse
No evidence shows tracking, sensitive-data collection, outside data sending, or remotely supplied code. [Q6][Q7][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Defines only metadata, icons, and a popup; there are no permissions, host_permissions, or content_scripts entries. — manifest.json:1-26
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No content script or host permission is declared. — manifest.json:1-26
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The popup contains only fixed navigation links and presentation elements, with no input fields. — views/popup.html:1-165
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests none of the relevant permissions. — manifest.json:1-26
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Every conversion option is a normal target=_blank link to a website; no file input or file API is present. — views/popup.html:15-159
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Contains local language selection and link rewriting only, with no fetch, XHR, beacon, form submission, or analytics client. — js/set_language.js:1-1291
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All text, locale choices, and destinations are packaged constants. — js/set_language.js:1-1291
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Opening the popup automatically localizes its labels; network navigation occurs only after the user clicks a link.
Reads navigator.language, selects packaged strings, updates popup elements, and runs once at popup load. — js/set_language.js:26-1291
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings-related permission. — manifest.json:1-26
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses straightforward named variables, a locale switch, and explicit fixed URLs. — js/set_language.js:1-1291
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads only packaged jquery.min.js and set_language.js scripts. — views/popup.html:163-164
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses navigator.language or navigator.browserLanguage to localize the popup. — js/set_language.js:26-33
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no network or persistence API. — js/set_language.js:1-1291
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookie or host permission and has no content script. — manifest.json:1-26
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Contains no user-input fields or event collection code. — views/popup.html:1-165
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
There is no inbound network, messaging, or remote-configuration channel. — js/set_language.js:1-1291
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Writes packaged translations into popup elements and changes popup anchors to fixed language-specific converter URLs. — js/set_language.js:1235-1288
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
User clicks open fixed HTTPS converter pages, but the extension does not intercept requests, proxy traffic, or download files.
Uses ordinary target=_blank anchors for office-converter.com, online-qrcode-generator.com, and online-barcode.com. — views/popup.html:15-159
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:1-26
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All logic, text, and destinations are packaged locally. — js/set_language.js:1-1291
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content script or externally_connectable configuration. — manifest.json:1-26
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses navigator.language without storage or server input. — js/set_language.js:26-33,1235-1288
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Defines no active background service worker; runtime code is limited to the popup. — manifest.json:1-26
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The extension popup contains links, not forms, and no webpage code is injected. — views/popup.html:1-165