What Is Sideloading a Chrome Extension and Is It Safe

Sideloading means installing a Chrome extension from somewhere other than the Chrome Web Store: a folder on your computer, a file someone sent you, or a download from a website. It's normal for developers, and risky for everyone else.

How sideloading works in Chrome

• Load unpacked: open chrome://extensions, turn on Developer mode, click Load unpacked and choose the extension's folder. This is how developers test their own extensions.
• Packed .crx files: on Windows and Mac, Chrome won't keep extensions from outside the Web Store enabled, unless an organization installs them through management policy.
• Policy installs: companies and schools can force-install extensions on managed devices.

Why Chrome limits it

Extensions can read and change the pages you visit, so malicious ones can steal logins, insert ads or redirect searches. Web Store extensions are reviewed before publishing, can be removed if they turn out to be harmful, and update automatically. Sideloaded extensions skip all of that.

The real risks

• No review. Nobody has checked the code except whoever gave it to you.
• No automatic updates. Unpacked extensions don't update, so security fixes never arrive unless you reload a new copy.
• Disguised malware. "Cracked" or modified versions of popular extensions are a common way to spread malware.
• Hidden installs. Malware has added extensions through management policies. If Chrome's menu says Managed by your organization on a personal computer, investigate.

When it's reasonable

• You're developing or testing your own extension.
• You've read the code of an open-source extension and downloaded it from its official source.
• Your employer provides an internal extension for work.

How to sideload more safely

1. Get it from the developer's official repository, not a mirror or forum.
2. Read manifest.json and check the permissions it asks for. See what each permission means.
3. Try it in a separate Chrome profile first.
4. Check for new versions yourself, since it won't update.
5. Remove it when you no longer need it.

Other browsers

Edge, Brave and Opera also support Load unpacked, and Edge has a setting to allow extensions from other stores, including the Chrome Web Store. See installing Chrome extensions on other browsers.

For most people, the Web Store is the right place to install from. Extensions installed there, such as Modern Dark Mode, update automatically. To check an extension you already have, see signs an extension has been compromised.