Permissions

Browsers describe permissions in the broadest terms they can, which is honest but not informative. This is the specific version: every permission the extension declares, what it is spent on, and what it still does not do.

Matches the manifest in v3.5.1 changelog

About that install warning

Chrome will tell you this extension can "read and change all your data on all websites". That wording is the same for every extension asking for broad host access, whether it reads one image on demand or scrapes every page you visit. The browser cannot tell those apart - so the rest of this page tells you which one this is.

What it asks for

Seven permissions. Six are requested on every browser; one exists only because Chrome's architecture requires it.

  • contextMenus

    Adds the right-click entries on images - save as JPG, PNG, WebP, AVIF or PDF, and the optional copy-to-clipboard item. This is the entire interface.

    It does not read anything. Registering menu items is all it does, and nothing runs until you pick one.

  • downloads

    Writes the converted file to your computer. It is the last step of a save you asked for.

    It does not download on its own, does not read your existing download history, and does not open what it saves.

  • activeTab

    Gives temporary access to the tab you are acting in, at the moment you invoke the extension. Two things need it: identifying the image you right-clicked (or the largest one on the page, if you use the keyboard shortcut), and taking the picture behind "Save visible area as...", which is converted on your device like any other image.

    It does not reach your other tabs, does not persist beyond that interaction, does not act on a page you have not invoked it on, and never captures anything you did not ask it to.

  • storage

    Keeps your own settings: default format, per-format quality, filename template, where files are saved, resize limits, capture format, what a batch save does with an animated image, the sites and image sizes the hover strip skips, theme, and which menu items are shown. Plus an optional local save history, off by default, and a reference to the folder you picked, if you picked one.

    It does not hold image data and it does not send anything anywhere. This is your browser's own storage, on your device.

  • notifications

    Tells you when a save fails, or warns you that the image you saved looks like a lazy-loading placeholder rather than the real photo - things you would otherwise never see.

    It does not carry promotions or offers, and it does not fire for anything you did not just trigger yourself.

  • clipboardWrite

    Backs the "Copy image as PNG" menu item, so the converted image lands on your clipboard instead of on disk.

    It does not read your clipboard. Writing and reading are separate permissions, and the read one is not requested.

  • offscreen Chrome and Edge only

    Chrome's background service worker has no DOM, so it has no canvas to convert with. This creates a hidden document that does the encode, then closes it.

    It does not render anything you can see and it does not outlive the conversion. Firefox has no such API, so that build converts in the content script instead.

Access to websites

The one broad permission, and the one worth reading properly. It is declared as <all_urls>, because images live on arbitrary domains and you choose which one at right-click time.

Fetching the image bytes

The background worker fetches the image you picked, which sidesteps the page's own CORS rules. A great many images cannot be read any other way, and the site an image lives on is not knowable before you right-click it.

Finding the image at all

A content script figures out what you actually right-clicked, including CSS background-image, <canvas> and <video poster> sources that the browser's own context-menu API does not report as images.

Nothing happens until you act

There is no background crawling, no automatic scanning, no periodic fetching, and no list of sites the extension targets. It is idle until you right-click an image and choose a format, and it goes back to idle when the file is saved. A narrower scope would not inconvenience the extension, it would break it: asking per site would trade one prompt at install for a prompt on every new page, on a tool whose whole value is being instant.

What it never asks for

Permissions an image tool could plausibly request, and the reason this one does not. Absent from the manifest, so the browser could not grant them even if the extension tried.

  • scripting The extension does not inject code into pages on the fly. This was declared in older versions and never used; 3.0.0 removed it, and the content script is statically declared in the manifest instead.
  • tabs The extension does not read the URL or title of the tabs you have open, which is what this permission would expose. activeTab covers what it actually needs.
  • webRequest The extension does not inspect, block, redirect or modify your network traffic.
  • cookies The extension does not read a cookie, on any site, for any reason.
  • history The extension does not read your browsing history.
  • identity The extension does not identify you. There is no account and nothing to sign in to.

Where the builds differ

Chrome and Firefox are separate builds with separate manifests. Edge is Chromium-based and uses the Chrome build unchanged.

Chrome and Edge

Declares offscreen so conversion can run in a hidden document. Ships anonymous analytics, on by default, covering which format was used and whether the save worked. You can turn it off in the extension's settings.

Firefox

No offscreen permission, because Firefox has no such API - conversion runs in the content script instead. This build ships no analytics code at all: the send path is removed at build time, so the bundle contains no measurement id and no endpoint. That is verifiable in the source archive published to AMO.

What leaves your device

Not your images. Every conversion runs on your own machine through the browser's Canvas API, with no conversion server involved at any point. Page contents, form data and browsing history are never read.

The storage permission holds your settings, plus an optional local save history that is off by default. If you turn it on in Settings, it keeps a per-save record - the image's URL, format, file size, and time - on your device only; it is never transmitted anywhere, and turning the setting off clears it.

On Chrome and Edge, anonymous usage events go to Google Analytics: which format was used and whether a conversion succeeded. If a conversion fails, the event also includes the bare hostname of the image - never the full URL, and never for data: or blob: images - plus a short diagnostic message, so the sites that break it can be found and fixed. Events are tied to a random id, never to your identity, and you can turn analytics off in the extension's settings.

Read the full privacy policy for the exact list of what is sent when a conversion fails.

Ready to convert images the right way?

Free and privacy-first. No account needed.

Add to Chrome Why we built this