Is Keepa - Amazon Price Tracker safe?
We analyzed Keepa - Amazon Price Tracker version 5.69's actual code and gave it a 58/100 trust score. Keepa fits its shopping feature, but its cookie…
Bottom line
Keepa fits its shopping feature, but its cookie access, broad Amazon coverage, tracking, and server-directed privileged requests create meaningful risk.
What it can access
It runs across many Amazon sites, reads page data and session cookies, and changes request headers for stock checks, exceeding ordinary chart-only access.[Q1][Q3][Q4][Q14]
Security weaknesses
Keepa's server can direct privileged web requests and alter request behavior or crawling without an extension update.[Q16][Q18][Q22]
Signs of misuse
The extension automatically sends Amazon observations and URLs to Keepa and supports server-directed crawling, though no downloaded code execution or unrelated web tracking was found.[Q6][Q12][Q16][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests cookies, storage, webRequest, offscreen processing, request-header modification, and persistent access to Keepa plus Amazon domains in many countries. Its page access runs at document start in all frames on those sites.
Declares the sensitive permissions, broad Amazon/Keepa host access, and automatic all-frame content script. — manifest.json:7-28
Which websites can it run on, and can it read or change what appears on those pages?
It inserts Keepa charts and controls into Amazon pages, watches page changes, and injects a packaged main-world hook that wraps Amazon product-variation state methods so it can learn the selected ASIN.
Finds insertion points, creates the Keepa iframe/graph UI, and updates it when products change. — content.js:718-1014
Hooks several Amazon variation-selection APIs and posts selected ASIN values back to the isolated content script. — selectionHook.js:1-122
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads Amazon product IDs, offers, sellers, ratings, quantities, stock limits, page URLs, session identifiers embedded in forms, and CSRF or add-to-cart tokens. No password, payment-card, message, or arbitrary typed-text capture was found.
Reads offer, stock, seller, ASIN, session-id, CSRF, and add-to-cart values for stock retrieval. — content.js:439-709
Scans search/category pages with server-provided filters and sends extracted product observations. — content.js:1311-1338
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads and writes Keepa and Amazon cookies and stores compressed extension/user cookie jars, cloud configuration, dictionary IDs, a Keepa token, settings, and an install timestamp in local extension storage.
Serializes named Amazon cookies and can remove or set cookies for an Amazon URL. — keepa.js:717-756
Temporarily stores the user's cookie jar, swaps guest cookies, restores cookies, and persists compressed jars. — keepa.js:904-919, 1017-1023
Stores server-supplied cloud configuration and its hash. — keepa.js:1065-1098
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no device, native messaging, file URL, or loopback permissions. — manifest.json:7-18
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends Amazon product and rating observations, product-page URLs, extension/install metadata, and parsed results from server-requested Amazon pages to Keepa. Bug reports can also include request URLs, session identifiers, errors, and execution context.
Forwards automatic content-script observations over the Keepa WebSocket. — keepa.js:1401-1436
Builds outgoing cloud responses with extracted payload, job IDs, guest session ID, status, and request metrics. — keepa.js:1863-1903
Posts rate-limited bug reports to Keepa. — keepa.js:1743-1775
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads remote configuration, extraction instructions, request templates, and compression dictionaries. Those values control crawling and parsing but are treated as data; no downloaded JavaScript execution was found.
Loads, stores, and applies remote stock/crawl configuration and downloads a validated Keepa dictionary. — keepa.js:1065-1175
Decodes server messages and routes configuration or fixed cloud-job types. — keepa.js:1792-1832
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically starts on Amazon pages, maintains a background WebSocket, periodically keeps the worker alive, scans eligible pages, and sends observations without a per-item user click. Stock requests are additionally triggered by the visible Keepa feature.
Runs the content script automatically at document_start in all frames. — manifest.json:24-29
Maintains and reconnects the persistent cloud WebSocket. — keepa.js:1779-1860
Automatically scans and re-scans supported Amazon search/category pages. — content.js:1311-1338
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no browser-setting, search-provider, new-tab, proxy, management, or downloads override. — manifest.json:1-44
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The main scripts are compacted and use generated symbol names, and the cloud protocol can be compressed with remotely supplied dictionaries. The package is small enough and retains enough semantic strings for its important paths to be traced, so this is review friction rather than strong concealment evidence.
Bundles a minified decompressor and cloud-frame codec before the application code. — keepa.js:1-520
Lists compacted content, background, and offscreen scripts without source maps. — inventory.json:files
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Targeted dynamic-code search found only normal function declarations/callbacks and packaged script injection. — keepa.js, content.js, offscreen.js, selectionHook.js:complete scripts
Does it track the websites, pages, searches, or links you visit?
It observes browsing within Amazon and Keepa—not the general web. It sends product-page URLs, product IDs, ratings and page-derived observations to Keepa, plus a periodic Amazon-content activity signal.
Supplies the current Amazon URL, domain, ASIN, extension version, token, and install value to the Keepa iframe. — content.js:750-774, 1021-1048
Sends content activity and collected product/rating data over the WebSocket. — keepa.js:1401-1436
Does it create a persistent ID or browser fingerprint to recognize you?
A 64-character Keepa account/device token, install timestamp, extension ID, version, and connection capabilities identify the installation to Keepa. Cloud responses are also linked to message IDs and the separate crawler session ID.
Builds the cloud URL with install time, extension ID, version, opt-out state, and capabilities, and authenticates with the Keepa token. — keepa.js:1792-1793
Returns message and crawler-session identifiers with job results. — keepa.js:1863-1870
Does it send cookies, session details, authentication data, or page contents elsewhere?
It can read and manipulate Amazon authentication/session cookies, including session-id and session-token. In the reviewed cloud path it preserves the user's cookie jar, performs work with separate extension guest cookies, blocks cloud response cookies from contaminating normal browsing, and restores the user's cookies.
Explicitly serializes session-id, session-token, and other cookies and implements cookie replacement. — keepa.js:717-756
Reads the user's Amazon cookies and creates isolation/header rules before a guest request. — keepa.js:873-920
Captures guest response cookies, detects accidental user-session overlap, restores the user jar, and persists only isolated state. — keepa.js:981-1023
Assigns extension-owned cookies and marks non-Keepa cloud jobs as guest requests. — keepa.js:1873-1879
Does it record typing, form entries, clipboard contents, or screenshots?
It reads Amazon page content such as products, offers, ratings, sellers, quantities, hidden session/CSRF fields, and selected product variants. It does not read arbitrary form typing, passwords, payment-card fields, clipboard contents, screenshots, camera, or microphone data.
Extracts stock and offer data plus hidden Amazon request tokens from page markup. — content.js:439-709
Reads selected product ASIN state from Amazon's page context. — selectionHook.js:1-122
Can a website or remote server send commands that make the extension take actions?
Keepa's server can send fixed cloud-job messages containing URLs, fetch options, header rules, cookies, regular-expression extraction filters, and parsing instructions. The extension executes the request through its privileged background and returns extracted results.
Accepts, decodes, and dispatches WebSocket messages to the cloud job handler. — keepa.js:1795-1836
Runs the server-provided request, applies extraction filters or an offscreen parser, and sends the result back. — keepa.js:1873-1950
Interprets job URLs, fetch options, cookies, DNR header templates, and request bodies in the privileged request engine. — keepa.js:832-975
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates visible Keepa containers, graph images, and iframes tied to its advertised feature. — content.js:718-1014
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It installs temporary declarativeNetRequest rules to set or remove Cookie and other headers, strip Set-Cookie, and constrain requests by Amazon domain and extension initiator. It also observes extension-initiated response headers through webRequest and parses Set-Cookie values.
Creates session-scoped request/response header rules around individual jobs. — keepa.js:764-784, 848-890
Registers an all-URL response-header listener and captures Set-Cookie only for requests initiated by this extension. — keepa.js:1103-1121
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission or loopback host is declared. — manifest.json:7-18
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Decodes remote cloud frames into JSON and dispatches only fixed message cases. — keepa.js:497-513, 1795-1836
Treats fetched HTML as text for regex or DOM parsing and returns data. — keepa.js:1873-1950
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes selectionHook.js to supported Amazon origins. — manifest.json:16-19
Validates Keepa origins and same-window Amazon ASIN messages before bridging them. — content.js:347-390
Reads Amazon page-world product state and communicates through window messaging. — selectionHook.js:1-122
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Server-delivered configuration can alter extraction filters, cookie ordering, seller/warehouse IDs, delays, stock services, header/body templates, and crawling behavior without a store update. An optOut_crawl setting is reported to the server, but the packaged code trusts accepted cloud configuration.
Persists and applies cloud configuration that changes cookie and stock/request behavior. — keepa.js:1065-1121
Reports the crawl opt-out value and current configuration hash when connecting. — keepa.js:1783-1793
Uses server-supplied scrape filters and request jobs. — keepa.js:1913-1917
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Keeps the worker and cloud connection active and reconnects after failures. — keepa.js:1250-1270, 1779-1860
Scans and monitors eligible Amazon result pages for up to three minutes. — content.js:1311-1338
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Collects offer, quantity, session, and CSRF inputs needed for stock retrieval. — content.js:439-709
Builds and sends an Amazon add-to-cart-style request and parses the returned quantity/limit. — keepa.js:1589-1628
Uses remote-configured geo and address-change requests to establish a guest stock-checking context. — keepa.js:1640-1738