An extension sees more of your browsing than almost any other software you install. It runs inside pages, often on every site, with access to what you have open and sometimes what you type. That is not a reason to avoid extensions. It is a reason to spend two minutes checking one before you install it, and most people never do, because it is not obvious what to look at.

Here is what to look at.

Local storage is a claim you can verify

"Your data stays on your device" appears in a lot of listings. It is checkable, and the check takes about a minute.

Open the extension's page in the Chrome Web Store and scroll to the privacy section. Every listing has a developer-declared table of what data is collected: personally identifiable information, browsing history, user activity, and so on. A genuinely local extension declares none of it. If the table lists browsing history or user activity, the data leaves your machine, whatever the marketing copy above says.

Firefox makes this even more explicit. Since the addition of data collection declarations, an add-on can state required: ['none'] in its manifest, which surfaces in the listing as a hard statement rather than prose. It is a declaration, not an audit, but a false one is a policy violation with a real consequence attached.

The second check is whether the extension needs an account. An extension that syncs across devices has to keep your data somewhere, and that somewhere is a server. Sync is a genuinely useful feature and there is nothing wrong with wanting it, but it is the opposite of local. If there is no login, there is usually nowhere for the data to go.

Permissions, and which ones matter

The permission list is the other half. Most of it is boring, and a few entries are worth pausing on.

  • storage is the boring one. It is local key-value storage. Almost everything requests it.
  • <all_urls> or "read and change all your data on all websites" looks alarming and often is not. Anything that modifies pages needs it, because it cannot know in advance which sites you will use it on. Judge it by what the extension is for. A tab manager probably does not need it. Something that draws on pages does.
  • debugger is the one to actually stop at. It attaches a devtools-protocol session to a tab, which is a lot of capability. There are legitimate uses, mostly around viewport and device emulation, and Chrome does not allow it to be requested optionally, so it appears at install time even for a feature you will never touch. If a listing asks for it, it should say in plain words which single feature it powers. If it does not say, that is your answer.
  • Anything requesting cookies, webRequest, or nativeMessaging deserves a specific justification in the listing.

A useful habit: read the permission list first, then the description, and see whether the description explains everything in the list. Extensions that quietly acquire permissions over time are the ones that turn into something else after an acquisition.

Where TheTab sits

TheTab keeps everything in local browser storage. There is no account, no server holding your saved tabs, and no sync, which is a deliberate trade. Your tab history is a fairly detailed record of what you have been working on, and the safest place for it is the machine it came from. Export to JSON is there for when you want to move it yourself, which keeps you in control of the copy.

That constraint is why it stays free without ads or data sales.

Another one worth knowing about

If you build frontends, Pixel Perfect Advanced fits the same shape. It overlays a design mockup on a live page so you can compare the build against the comp pixel by pixel, with the compositing set to difference so anything that matches renders black and only the drift is visible.

Everything is stored per site in local extension storage, with the images in IndexedDB on your machine. No account, and no analytics SDK in the build. Worth noting on its own terms: the Chromium version does request debugger, for exactly one feature, resizing the viewport to a target width without resizing your window. The Firefox build does not request it, because Firefox has no equivalent API. That is the kind of thing a listing should tell you up front, and it is the standard being applied here.

It is on Chrome and Firefox, free, with no paid tier holding features back. There is a technical write-up of how the overlay works on NoWaterProgramming if you want the implementation rather than the pitch.

The short version

Check the privacy declaration, check whether it needs an account, read the permission list before the description, and be suspicious of anything asking for capability it does not use. Local-first is not a premium feature. For a lot of tools it is simply the correct design, and it usually costs less to run, which is why the tools built that way tend to stay free.