Is One Quick Calculator safe?
We analyzed One Quick Calculator version 1.9.32's actual code and gave it a 86/100 trust score. This appears to be a reasonably trustworthy calculator…
Bottom line
This appears to be a reasonably trustworthy calculator with limited user-triggered page access and no evidence of spying or abuse.
What it can access
It can add a calculator to the active page and sync calculation history, while copying or exporting results only after user action; this fits its purpose but exposes some page and data access. [Q1][Q5][Q6]
Security weaknesses
The code is mostly reviewable, with a large minified math library as the main review limitation and no demonstrated website path to privileged actions. [Q10][Q21]
Signs of misuse
There is no evidence of tracking, sensitive-data collection, remote commands, traffic manipulation, or downloaded code execution. [Q7][Q12][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, activeTab, and scripting. These allow temporary injection into the page the user explicitly activates, plus local/synced calculator state; it has no persistent website access or automatic page access.
Declares storage, activeTab, scripting and no host_permissions/content_scripts. — manifest.json:1-46
Which websites can it run on, and can it read or change what appears on those pages?
After user initiation it inserts a fixed launcher and resizable calculator panel in a closed shadow root. It does not read or rewrite existing page page, text, styles, inputs, or forms beyond appending/removing its own isolated host element.
Creates/removes extension-owned host, shadow UI, iframe, controls, and geometry only. — page-calculator.js:1-687
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No host-page selectors or data extraction; overlay content is an extension URL. — page-calculator.js:1-687
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The background identifies the currently active normal tab and window only to inject/toggle the requested overlay or position a pop-out. It does not read the active page URL/title, enumerate browsing history, or retain tab metadata.
Gets the active tab ID and focused-window geometry for UI placement and messaging. — background.js:24-126
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
An explicit copy button writes a calculation to the clipboard, and export creates a local text download. The overlay iframe declares clipboard read/write allowance, but application code only writes and never reads the clipboard.
Copies selected result and exports history to a local Blob download after clicks. — popup.js:373-438
Embeds the extension calculator iframe with clipboard allowance. — page-calculator.js:575-590
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
History, saved calculations, and rounding preference are stored in chrome.storage.sync and may therefore be transmitted by Chrome's account-sync service to the user's other devices. The popup also references Google Fonts and cdnjs CSS, but no calculation content is deliberately sent to those hosts or the developer.
Reads/writes history, savedItems, and roundOff through storage.sync. — popup.js:52-63,139-176,320-468
Links Google Fonts Material Icons and cdnjs Font Awesome stylesheets. — popup.html:1-12
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads packaged Math.js/popup.js; only stylesheets are remote. — popup.html:1-12,190-193
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The popup evaluates as the user types and restores the last expression; the pop-out opens from a keyboard command. Page injection occurs only after the user invokes the active-tab feature, and injected UI immediately opens by design.
Injects page-calculator.js only on toggle-page-calculator and handles the explicit pop-out command. — background.js:109-156
Restores and evaluates the extension's own input. — popup.js:52-72,470-487
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-setting, management, proxy, downloads, or request-modification permissions. — manifest.json:1-46
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party files are readable and modest. The 712 KB minified Math.js bundle has no source map and dominates the package, reducing dependency reviewability but showing no custom obfuscation or packed hidden data.
Records readable first-party code and one large minified Math.js dependency. — inventory.json:complete file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Passes expression text to packaged math.evaluate. — popup.js:474-496
Math.js 11.9.1 bundle contains parser/compiler logic but no eval/new Function text-to-JavaScript sink found by targeted review. — libs/math.min.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses active tab ID only for page-calculator messaging/injection. — background.js:83-126
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
No analytics or identifier logic. — background.js, popup.js, page-calculator.js:complete files
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies, identity, webRequest, or host permissions. — manifest.json:1-46
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Input/key handlers operate on expressionInput inside the extension page. — popup.js:470-627
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Accepts three fixed internal runtime message types. — background.js:137-156
Accepts parent messages only in page-modal mode. — popup.js:232-299
Validates event.source against its calculator iframe. — page-calculator.js:329-379
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Injected UI contains only calculator launcher/panel controls. — page-calculator.js:380-630
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No network interception or downloads permission. — manifest.json:1-46
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No native/local service communication. — background.js, popup.js, page-calculator.js:complete files
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Builds history entries with raw expression inside an innerHTML template. — popup.js:338-374
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Makes calculator resources web-accessible on <all_urls>. — manifest.json:26-39
Message handlers validate source and fixed message types. — page-calculator.js:329-379,631-649
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Selects extension UI mode and local settings. — popup.js:1-125
Uses stored geometry and open/minimized state. — page-calculator.js:1-687
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Evaluates the full expression on each input update. — popup.js:474-496
Provides matrices, combinatorics, symbolic and numerical operations beyond basic arithmetic. — libs/math.min.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Adds extension-owned shadow UI without querying or changing host forms. — page-calculator.js:380-630