52

I want to know if i write a Google Chrome extension, will anyone be able to use my code?

Kara
  • 6,115
  • 16
  • 50
  • 57
NYC2012
  • 675
  • 1
  • 6
  • 5
  • John is right, and now that I re-read the question I agree. If you want to know whether they're open source, this is not the site for that. If you want to know whether other people can see the source, then potentially yes like I stated in my answer. – Jaime Garcia Apr 27 '10 at 20:28
  • 1
    I don't think this is a legal question, I think he's just asking if it's possible to see the source of an installed Chrome extension. – Jason Hall Apr 27 '10 at 20:30
  • 1
    yes i wanted to know if people could see my code, thank you for your reply – NYC2012 Apr 27 '10 at 21:25
  • 6
    @NYC2012 -- "Open Source" does not just mean they can read your code. For example: lots of proprietary software is written in .NET or Java, where the code can very easily be reverse-engineered. There is proprietary JavaScript, which is fully visible. Open-Source is a legal concept, not a technical one. – STW Jul 15 '10 at 18:22

7 Answers7

32

It looks like people will be able to see your code. If they can see your code, they can potentially use it.

  • Windows: C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions
  • Linux and Mac:
    • ~/Library/Application Support/Google/Chrome/Default/Extensions/ or
    • ~/.config/google-chrome/Default/Extensions/

The source code is available for inspection/debugging/experimenting & whatever people might want to do. You may try to use a JavaScript obfuscator.

Community
  • 1
  • 1
Jaime Garcia
  • 6,744
  • 7
  • 49
  • 61
  • 2
    This answer is Windows-specific - what are Linux and Mac users supposed to do? – Anderson Green Dec 06 '12 at 03:49
  • 1
    This may be the path for some mac users; ~/Library/Application Support/Google/Chrome/Default/Extensions – Taylan Jun 08 '13 at 14:03
  • 2
    On a more recent version of Windows (> XP): `C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions` – Gabriel Dec 06 '13 at 10:11
  • @Gabriel please submit your comment as an answer, as the current answer is obsolete – Omar Apr 24 '20 at 11:24
  • @AndersonGreen: an OS-agnostic way to locate your extension is to type `about:version` in the address bar and hit **Enter** — under **Profile Path** you'll have the folder for your current browser profile, and inside that folder you'll find an **Extensions** folder. Look up the extension folder name under `about:extensions` (switch to developer mode). – ccpizza Sep 27 '20 at 10:45
20

Since Chrome Extensions are written in JavaScript, and everyone can open the Inspector and see the resources for every extension then, yes, everyone can see the source of your extension. This doesn't mean they'll be able to use it. If you obfuscate the code or use similar techniques to make the code less readable then you can avoid that others look into how your extension works. But as said, they can still use the Inspector to analyze the extension.

If you must hide the secret algorithm in your extension, then you could use a server back-end to handle the secret stuff, completely avoiding anyone can look at your code.

Henrik Hansen
  • 2,180
  • 1
  • 14
  • 19
  • 1
    Thank you Henrihk, you answered my question. I want to make my stuff secret therefore i will use a server to pass the info – NYC2012 Apr 27 '10 at 21:16
  • The problem then becomes can we secure the API calls to our server? –  Jan 17 '21 at 19:24
17

Although the question has been posted long time ago, and received some answers (none accepted), I am adding my answer to complete previous answers.

Open-source, referring to software, refers to a «source code made available with a license in which the copyright holder provides the rights to study, change and distribute the software to anyone and for any purpose.» (source: Wikipedia)

Unless explicitly stated, software is copyrighted by the author. Even if you have access to sources, without an explicit permission, you can't read it. It's as if you find opened the door of a house; you have the ability to look into it and even walk in. But you don't have any rights to do it, and doing it is likely to put you in trouble.

Everybody can view source code of your extension because it's written in javascript. Nobody has the right to reuse, change and/or distribute your code without your explicit permission.

Moral of the story: never put any sensitive data in your extensions, because it's extremely insecure.

About Open Source, I suggest to read also the Open Source Definition by OSI

David
  • 2,987
  • 1
  • 29
  • 35
6

Even though Chrome extensions' source code are accessible by the public, it doesn't mean all Chrome extensions are open source. Actually, you don't have the right to copy/reuse/modify their source code either partially or completely, without their authors' permission, except when he/she has announced that it's open source.

Robin Green
  • 32,079
  • 16
  • 104
  • 187
ntuan16
  • 198
  • 2
  • 9
1

Every Chrome Extension gives the user the following rights by default:

5.2 You grant to the user a non-exclusive, worldwide, and perpetual license to perform, display, and use the Products and any content contained in, accessed by, or transmitted through the Products in connection with Google Chrome. If you choose, you may include a separate end user license agreement (EULA) in your Product that will govern the user’s rights to the Products in lieu of the previous sentence.

Read the whole agreement here: http://developer.chrome.com/webstore/terms

That doesn't mean that the user has the right to alter and/or distribute your code, but as others have pointed out, they will be able to see your JavaScript if they want to.

Chuck Le Butt
  • 47,570
  • 62
  • 203
  • 289
1

I am not sure whether they are open-source or not, but you can easily see the code of any chrome extension. It is also up to the developers how their code are structured so that whether other can use it by just copy paste or by analyzing the script code.

However, you can also use the Console to analyze the javascript code and use it.

Also, there is a easy and simple in tool in Google Chrome store to view any chrome extension code.

You can download it here (CRX Viewer)

https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin

Steps to see code using CRX Viewer :

1) Now after installing the Extension, open it and paste the link of the other extension(which you want to see the code). enter image description here

                        ScreenShot of the step

2) Now click "Open in this Viewer" and Here we go ....

enter image description here

                     Generated source code of extension

3) Now you can easily download the code,or view one by one.

Deepak Kumar
  • 387
  • 4
  • 6
-2

Yes they will, it's mandatory open source !

Ashraf Bashir
  • 9,686
  • 15
  • 57
  • 82