Short answer: most Chrome extensions are safe, but "most" is doing a lot of work in that sentence. Extensions run inside your browser, next to your email, your banking and your passwords - so the right question is not "are extensions safe in general" but "can I tell whether THIS extension is safe". You can, in about two minutes, without any technical background.
How Chrome extensions actually get access
Every extension must declare permissions - a fixed list of things it is allowed to touch. Chrome shows them at install time and on the extension's Web Store page under "Privacy practices". An extension cannot quietly grant itself more access later: widening permissions triggers a new review and a new prompt.
Permissions have very different weights. "Storage" (saving its own settings) is harmless. "Read your browsing history" or "Read and change all your data on all websites" are serious - legitimate tools do need them sometimes (an ad blocker cannot work without seeing pages), but they deserve a moment of thought: does this extension's job actually require this?
A five-point check before you install
- Match permissions to the job. A tab manager needs tabs. A screenshot tool needs the current page. A wallpaper extension asking to "read data on all websites" is a red flag.
- Read the "Privacy practices" tab on the Web Store listing. The developer must declare what data is collected. "No data collected" is the gold standard - and it is a binding declaration, not marketing.
- Check the developer. A real website, a support email and other extensions with reviews beat an anonymous one-off. Google's "Featured" badge means the listing passed a manual review.
- Read the one-star and three-star reviews. Five-star reviews are noise; the middle ones tell you how the extension behaves after a month.
- Prefer extensions with a reason to exist without your data. Free-forever tools with no business model have to make money somehow - sometimes from you. A clear free/paid model is a healthy sign.
Red flags after installing
Uninstall and report an extension if it starts opening tabs you did not ask for, changes your search engine or new-tab page without permission, injects extra ads into pages, or asks for broad new permissions in an update that has nothing to do with new features. Chrome shows "This extension requests additional permissions" - that prompt is your friend; read it.
What "no data collected" should actually mean
The strictest standard an extension can hold itself to is local-first: everything you do stays in your own browser, nothing is sent to any server, and there is no account and no analytics. That is the standard we build every AddonLoft addon to - our privacy policy is one page long because there is nothing to disclose. The declaration on each Web Store listing reads "no data collected" because none is.
You do not have to take any developer's word for it, ours included: the Web Store declaration, the permission list, and the behavior described in the documentation should all tell the same story. When they do, that is what a trustworthy extension looks like.
Quick answers
Can a Chrome extension read my passwords?
Only if you grant it access to the pages where you type them. This is why "read data on all websites" is the permission to take seriously - grant it only to tools whose job clearly requires it, from developers you trust.
Do extensions slow Chrome down?
Each active extension costs some memory. A handful of small, focused extensions is usually invisible; a dozen heavyweight ones is not. Chrome's built-in Task Manager (Window menu) shows exactly what each one costs.
Is it safer to have fewer extensions?
Fewer moving parts is always safer, but the real lever is quality over quantity: five well-chosen, well-permissioned extensions are safer than one careless install. Audit yours at chrome://extensions once in a while and remove what you no longer use.