Is Hide All From Instagram Story safe?
We analyzed Hide All From Instagram Story version 1.2.6's actual code and gave it a 88/100 trust score. This appears to be a purpose-aligned Instagram…
Bottom line
This appears to be a purpose-aligned Instagram helper with limited site access and no established misuse.
What it can access
It can inspect tab information and read Instagram usernames on one story-settings page to change visibility, which fits its stated purpose but involves limited personal data.[Q1][Q2][Q3]
Security weaknesses
No meaningful weakness is established: remote payment replies do not control actions, and ordinary websites lack exposed privileged features.[Q11][Q16][Q21]
Signs of misuse
It contacts its payment service for subscription status, but no evidence shows credential collection, browsing tracking, or unrelated data sharing.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can inspect tab URLs generally, while page access is limited to Instagram's story-visibility settings path.
Requests tabs and storage and injects content.js only at instagram.com/accounts/hide_story_and_live_from/*. — manifest.json:7-27
Which websites can it run on, and can it read or change what appears on those pages?
On the Instagram settings page it reads the user rows, usernames, and current hidden or visible state.
Queries Instagram's user-row elements, extracts displayed usernames, and detects filled versus outline visibility controls. — content-scripts/content.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads Instagram usernames shown in the story-visibility list, but not posts, messages, passwords, or unrelated profile data.
Reads the textContent of the username label inside each settings row solely for progress and exemption matching. — content-scripts/content.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores exemption-group names and ExtensionPay subscription metadata, but has no history, cookies, downloads, bookmarks, or password access.
Reads and writes groups in storage.local; the bundled ExtensionPay client stores install time, API key, and user status in sync storage with local fallback. — chunks/popup-Eblljihb.js:1
Requests storage and tabs only. — manifest.json:7-11
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant permissions. — manifest.json:7-11
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends an extension-specific services key and subscription-status requests to ExtensionPay; no Instagram usernames, URLs, or credentials are included.
The bundled ExtPay client contacts extensionpay.com/extension/hide-instagram-story for a key, current plans, and user payment state. — background.js:1-21
Calls ExtPay.getUser and opens payment or login pages from clearly labeled premium controls. — chunks/popup-Eblljihb.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
ExtensionPay supplies payment status and plan information, but it does not control Instagram actions or deliver executable code.
Parses fixed JSON fields from fixed ExtensionPay API endpoints and stores payment state. — background.js:1-21
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The background checks payment state and observes tab URL changes automatically, but hiding and unhiding require an explicit popup command.
Calls getUser at worker startup and listens for tab URL updates. — background.js:21
Sends hideUsers, unHideUsers, or cancel only from the matching popup buttons. — chunks/popup-Eblljihb.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings or network-settings permission. — manifest.json:7-11
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Retains clear selector constants, message action names, loop structure, and feature logic. — content-scripts/content.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Remote ExtensionPay responses are handled as payment JSON; apparent eval text is browser-polyfill API metadata, not a call. — background.js:1-21
Executes only packaged DOM automation code. — content-scripts/content.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
tabs.onUpdated sends {action: tabUrlChanged, url} through runtime messaging whenever changeInfo.url exists. — background.js:21
The popup receives that internal signal and re-queries the active tab only to decide whether Instagram settings are open. — chunks/popup-Eblljihb.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
External requests are confined to ExtensionPay subscription management. — background.js:1-21
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission and limits injected code to the story-visibility settings page. — manifest.json:7-27
Uses visible DOM controls and usernames without cookie or token access. — content-scripts/content.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads username labels and clicks visibility controls; it registers no input or keyboard collector. — content-scripts/content.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
ExtensionPay responses are consumed as paid, trial, plan, and date fields and do not select DOM actions or provide commands. — background.js:1-21
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
hideUsers and unHideUsers select the corresponding icon controls, scroll rows into view, click at 1.3-second intervals, enforce a free limit of 20, and stop on cancel. — content-scripts/content.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:7-27
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:7-11
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fixed ExtensionPay endpoints return JSON used only for subscription state and purchase flows. — background.js:1-21
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry. — manifest.json:1-27
Accepts internal runtime actions only; WXT's window message is limited to duplicate-script lifecycle handling. — content-scripts/content.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Provides Hide, Unhide, Cancel, group editing, exemption selection, upgrade, and login controls. — chunks/popup-Eblljihb.js:1
Uses isPremium for the limit and exemptUsers to skip configured usernames. — content-scripts/content.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Work consists of paced DOM enumeration, scrolling, and clicks on one settings page. — content-scripts/content.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Interacts only with Instagram's story-visibility toggle controls and displayed username labels. — content-scripts/content.js:1