Is Web Clipper safe?
We analyzed Web Clipper version 1.42.0's actual code and gave it a 62/100 trust score. Web Clipper is useful for user-triggered clipping but requests…
Bottom line
Web Clipper is useful for user-triggered clipping but requests broad page access and can handle sensitive content and service credentials, creating meaningful privacy and security risk.
What it can access
It can read pages across all websites and optionally access cookies, while clipping can send selected content or screenshots to services you configure.[Q1][Q2][Q14][Q15]
Security weaknesses
Service credentials may be stored in browser sync storage without application-level encryption, and minified code makes review harder.[Q4][Q10]
Signs of misuse
Clipped content, images, and service authentication are sent to user-selected destinations, with no evidence of unrelated tracking or hidden collection.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs a page access on all sites and can request optional all-site and cookie access for configured integrations.
Declares an all-sites content script, optional all-site host access, optional cookies, storage, activeTab, and request-header modification. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
When clipping is invoked, packaged extractors can read page content, title, URL, images, and the user's selection.
Implements selection-to-Markdown, Readability-based article parsing, page metadata access, and packaged clipping plug-ins. — content_script.js:2
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
User-selected or article content may include sensitive text from the current page, but it is collected only during an explicit clipping workflow.
Clones the current selection or parses the current document for conversion to Markdown. — content_script.js:2
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
Account configurations—including tokens or passwords for some services—are serialized into Chrome sync storage without application-level encryption.
Merges service form values into account objects and writes the accounts JSON through the Chrome sync storage service. — tool.js:2
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A user-selected tool can capture the visible tab, crop it, and upload the resulting image to the configured image host; local file download is also supported.
Uses captureVisibleTab for the screenshot plug-in and provides a user-triggered Blob download helper. — tool.js:2
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends clipped text and images to the note or image-hosting service explicitly configured by the user.
createDocument and uploadImage implementations target selected services such as Notion, GitHub, WebDAV, Yuque, Joplin, and others. — tool.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Builds the extension and context-menu lists from packaged webpack modules and notes that remote data was removed in version 1.34. — tool.js:2
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Toolbar, context-menu, and save-selection command handlers start the clipping UI or selection workflow. — background.js:2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting or proxy permissions. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application is shipped as several large minified webpack bundles, making independent review difficult, although module structure and library notices remain visible.
Contains a multi-megabyte minified webpack bundle with application and third-party modules. — tool.js:2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains compatibility helpers and a schema expression compiler using new Function; schemas and plug-ins are packaged locally. — tool.js:2
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
getPageUrl returns location.href and the Link plug-in reads document.URL during the clipping workflow. — content_script.js:2
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The active network integrations are user-configured note and image destinations; the bundled changelog says remote account and configuration data were removed. — tool.js:2
Does it send cookies, session details, authentication data, or page contents elsewhere?
For selected integrations it can read that service's cookies or use supplied tokens and passwords; access is permission-gated and directed back to the intended service, not an unrelated party.
Notion, Wolai, Buildin, and similar adapters read cookies for their own origins and temporarily attach them to matching API requests; account secrets are stored in sync storage. — tool.js:2
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture selected page text, article content, and a visible-tab screenshot after user action; no keystroke logging or microphone/camera capture was found.
Implements page/selection extraction and screenshot selection without keylogging, microphone, or camera APIs. — content_script.js:2
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Dispatches a fixed set of internal channels and packaged clipping actions. — background.js:2
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds and toggles the packaged tool.html iframe, loading overlay, and area selector. — content_script.js:2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It performs network uploads to user-selected destinations and can temporarily modify request headers to authenticate those same services.
Creates temporary declarativeNetRequest rules keyed by a random URL marker and removes them after the request. — background.js:2
Uses the temporary header mechanism for configured service API requests. — tool.js:2
Can it communicate with software on the computer or services running on localhost?
Optional Joplin and SiYuan integrations can communicate with local HTTP services after the user configures them; no native messaging or shell execution exists.
Includes user-selected clients for localhost Joplin and SiYuan endpoints. — tool.js:2
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All service adapters, clipping plug-ins, schemas, and lifecycle functions are bundled in the package. — tool.js:2
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Registers chrome.runtime messaging for fixed internal content-script commands and no window message listener. — content_script.js:2
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Checks and requests each service's declared optional permission before account setup or use. — tool.js:2
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background behavior is limited to clipping UI, permissions, cookies, tabs, and request helpers. — background.js:2
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Page changes are limited to the packaged clipping iframe, loading overlay, and selection UI. — content_script.js:2