18 Chrome Extensions for Web App Security Testing (2026)

Updated October 2026. We rechecked every extension on this list against the Chrome Web Store in September 2026 and trimmed it to 18 maintained tools. Eight of the Web Store links in the original 2020 article now lead to unavailable listings, one more tool is a Manifest V2 package that current Chrome won’t run, and several others had no working listing at all. We also dropped two payload cheat-sheet extensions, because this list is about reviewing your own sites, not attacking anyone else’s.

These extensions help developers, site owners and security teams check their own web applications: spotting outdated JavaScript libraries, finding exposed .git folders, seeing which services a server shows to the internet, and checking how cookies and headers are set. They won’t replace a full testing proxy such as Burp Suite or OWASP ZAP, but they catch a lot of common mistakes in a few minutes.

Only test sites and systems you own or have written permission to test. Probing other people’s sites without permission is illegal in most countries, even with a free browser extension.

What changed since the original list

Two things forced a rewrite.

• Manifest V2 is gone. Google disabled Manifest V2 extensions for all Chrome users with Chrome 138 in July 2025, and on August 31, 2026 it removed the remaining Manifest V2 extensions from the Chrome Web Store (Chrome for Developers). Older tools that were never updated simply stop working.
• Many listings disappeared. When we checked each link from the old article, these items returned the Web Store’s “unavailable” page: Tamper Chrome, Proxy SwitchySharp, Proxy SwitchyOmega (the original), Bishop Vulnerability Scan, Site Spider Mark II, Classic Cache Killer, Request Maker and EditThisCookie (the original listing). Open Port Check Tool is still a Manifest V2 package, which current Chrome won’t run.

We also dropped entries we couldn’t match to a live Web Store listing (Form Fuzzer, XSS Rays, WebSecurify, Port Scanner and iMacros), plus XSS ChEF, which was a proof-of-concept exploitation framework rather than a store extension. The old article also described Tamper Data, which was a Firefox add-on, and linked it to the retired Tamper Chrome listing.

The 18 extensions at a glance

Reconnaissance and fingerprinting extensions

Recon, sometimes called information gathering or banner grabbing, tells you what a site runs so you can look up known vulnerabilities for those versions.

1. Wappalyzer

What it does: Identifies the content management system, web server, JavaScript frameworks, analytics tools, CDN and other technologies a site uses, often with version numbers.

Why it helps in a security review: A quick first look at a target. Version numbers point you to the CVEs worth checking. It was the most widely used extension on this list when we checked, with about 3 million users.

Wappalyzer on the Chrome Web Store

2. BuiltWith Technology Profiler

What it does: Another technology profiler that pulls from BuiltWith’s database, including hosting, email and advertising providers.

Why it helps in a security review: A second opinion when Wappalyzer misses something, especially third-party services. Its listing was last updated in 2022, but it is a Manifest V3 package and still installs.

BuiltWith Technology Profiler on the Chrome Web Store

3. Shodan

What it does: Shodan’s official extension. It shows where the current site is hosted, who owns the IP address and which other ports and services Shodan’s internet-wide scans have seen on it.

Why it helps in a security review: Passive port and service discovery without sending a single packet to the target yourself. It replaces the old port-scanner extensions, which are no longer available.

Shodan on the Chrome Web Store

4. IP Address and Domain Information

What it does: Shows DNS records, IP geolocation, hosting provider, ASN and routing details for the site you’re on.

Why it helps in a security review: Mapping who hosts a target and which other domains share its infrastructure.

IP Address and Domain Information on the Chrome Web Store

5. Wayback Machine

What it does: The Internet Archive’s official extension. It shows archived copies of the page you’re viewing.

Why it helps in a security review: Finding old pages, parameters and endpoints that have vanished from the live site but may still work on the server.

Wayback Machine on the Chrome Web Store

6. DotGit

What it does: Checks each site you visit for exposed .git, .svn and .hg folders, plus .env and .DS_Store files, and notifies you when it finds one.

Why it helps in a security review: Catching a common and serious misconfiguration: an exposed Git folder can leak source code, credentials and API keys. It covers the main job the retired Bishop Vulnerability Scan used to do.

DotGit on the Chrome Web Store

7. Retire.js

What it does: Scans pages for JavaScript libraries with known vulnerabilities, such as old versions of jQuery or AngularJS, using the Retire.js database.

Why it helps in a security review: Flagging outdated front-end libraries, a finding that appears in almost every web app test. The listing is published by the Retire.js project’s author.

Retire.js on the Chrome Web Store

8. Link Gopher

What it does: Extracts every link on a page and lists them, with a filter for domains.

Why it helps in a security review: Quick manual mapping of a site’s links and third-party domains. For a full crawl, use your proxy’s spider instead.

Link Gopher on the Chrome Web Store

Web application testing extensions

9. OWASP Penetration Testing Kit

What it does: An open-source OWASP project that works inside your live, logged-in browser session. It captures the HTTP requests your browsing generates, runs selected dynamic (DAST) checks against them, and analyzes loaded JavaScript and HTML for insecure patterns.

Why it helps in a security review: Testing authenticated workflows that are awkward to reproduce in a separate scanner. It was updated in September 2026, which makes it one of the most actively maintained tools here.

OWASP Penetration Testing Kit on the Chrome Web Store

10. d3coder

What it does: Encodes and decodes selected text from the right-click menu, including Base64, ROT13 and Unix timestamp conversion. You can customize which conversions appear in the menu.

Why it helps in a security review: Decoding tokens and parameters you find while testing. For more on how these schemes differ from real encryption, see our guide to {L(“cryptography-tools”,”cryptography tools”)}.

d3coder on the Chrome Web Store

11. Cookie-Editor

What it does: Lets you view, add, edit, delete, import and export cookies for the current site.

Why it helps in a security review: Testing session handling, cookie flags and authorization checks. It replaces the original EditThisCookie, whose listing is gone. Be careful with lookalikes: removed extensions tend to attract malicious clones, so install from the exact listing.

Cookie-Editor on the Chrome Web Store

12. User-Agent Switcher and Manager

What it does: Changes the browser’s user-agent string, per site if you want.

Why it helps in a security review: Checking whether a site serves different content, or different security controls, to mobile devices, bots or old browsers.

User-Agent Switcher and Manager on the Chrome Web Store

13. Talend API Tester

What it does: A request builder for HTTP and REST APIs, with support for custom headers, bodies, authentication and saved scenarios.

Why it helps in a security review: Crafting and replaying requests by hand. It fills the gap left by Request Maker and Tamper Chrome. For interception, route traffic through Burp Suite or ZAP.

Talend API Tester on the Chrome Web Store

Proxy and workflow extensions

14. FoxyProxy

What it does: Switches Chrome between proxy profiles, with URL pattern rules.

Why it helps in a security review: The standard way to send browser traffic to Burp Suite or OWASP ZAP with one click, and to send only in-scope domains through the proxy.

FoxyProxy on the Chrome Web Store

15. Proxy SwitchyOmega 3 (ZeroOmega)

What it does: A Manifest V3 fork of the popular SwitchyOmega proxy manager, with auto-switch rules and PAC script support.

Why it helps in a security review: Managing several upstream proxies with rules. It’s a direct replacement if you relied on the original SwitchyOmega or SwitchySharp.

Proxy SwitchyOmega 3 (ZeroOmega) on the Chrome Web Store

16. Clear Cache

What it does: Clears the cache, and optionally cookies and other site data, with one click.

Why it helps in a security review: Retesting a page without stale cached responses. It replaces Classic Cache Killer.

Clear Cache on the Chrome Web Store

17. Web Developer

What it does: Adds a toolbar for inspecting and changing pages: show hidden form fields, disable JavaScript, view cookies, outline elements and more.

Why it helps in a security review: Revealing hidden inputs and client-side restrictions you can then test against the server.

Web Developer on the Chrome Web Store

18. Note Anywhere

What it does: Pins sticky notes to specific web pages and brings them back when you return.

Why it helps in a security review: Keeping findings and reminders attached to the exact pages you’re testing. Don’t store client secrets in it.

Note Anywhere on the Chrome Web Store

How to install security extensions safely

Extensions run with broad access to the pages you visit, so a compromised one can steal session cookies and passwords. In December 2024, attackers phished the developer of Cyberhaven’s Chrome extension and pushed a malicious update to it and dozens of other extensions (BleepingComputer). A few habits reduce the risk:

• Use a separate Chrome profile for testing. Keep testing extensions out of the profile you use for email, banking and admin consoles.
• Install from the exact listing. Check the publisher, user count and last-updated date. Be suspicious of new listings that copy the name of a removed tool.
• Limit site access. In chrome://extensions, set an extension’s site access to “On click” or specific sites when you can.
• Remove what you don’t use. Fewer extensions means a smaller attack surface.
• Keep Chrome updated so extensions get Chrome’s latest security fixes and policy checks.

For desktop tools that go beyond the browser, such as Burp Suite, Nmap and Wireshark, see our roundup of cybersecurity tools. If you’re building these skills for a job, our guide on moving into a cybersecurity career covers where to start.

For a short weekday roundup of new vulnerabilities, breaches and tools, sign up for the CyberExperts Daily Brief.

Frequently asked questions

Sources

• Chrome for Developers, Manifest V2 support timeline: developer.chrome.com
• Chrome Web Store listings for each extension, checked September 25, 2026 (linked in each entry above)
• Chrome Web Store Help, Install and manage extensions: support.google.com
• BleepingComputer, New details reveal how hackers hijacked 35 Google Chrome extensions: bleepingcomputer.com
• OWASP Penetration Testing Kit project: owasp.org
• Retire.js project: retirejs.github.io

George Mutune

I am a cyber security professional with a passion for delivering proactive strategies for day to day operational challenges. I am excited to be working with leading cyber security teams and professionals on projects that involve machine learning & AI solutions to solve the cyberspace menace and cut through inefficiency that plague today's business environments.