Can a Grammar Checker Extension Read Everything You Type? Permissions and Text Processing Explained

The short answer

Yes, a grammar checker extension can have the technical ability to read everything you type on any page. Most of them request site access that grants exactly that, because they cannot know in advance which field you will want corrected next. Whether a given extension actually reads everything you type is a different question, and the permissions list will not answer it.

The useful move is to stop treating permissions as a verdict and start treating them as a description of the blast radius. Then answer the second question with evidence: when is text captured, where does it go, and can you watch it happen.

Capability is not collection

This is the distinction most articles on extension privacy skip, and skipping it makes the whole subject unactionable. Two extensions can hold identical permissions and behave completely differently.

A permission is a grant of ability. 'Read and change all your data on all websites' means the browser will let this extension inspect and modify any page you visit, if its code chooses to. It does not mean the code does. Conversely, an extension with almost no permissions that adds a single keystroke logger to the one field it can reach is worse than a broadly-permissioned tool that only ever reads a field when you click its icon.

Why does a grammar checker need broad site access at all? Because it cannot predict where you will write. A correction tool that only worked on Gmail would be useless to the person who needs it in a job application form, a Notion page or a support desk widget. So the category as a whole converges on broad access, which means broad access on its own tells you nothing about a specific product. What tells you something is the capture model.

Where the text actually goes

Here is our own flow, described as it is rather than as it sounds best. This is a diagram of One Shot Fix, verified by the developer who built it, not a generic illustration.

  [ You click the toolbar icon ]
                |
                | nothing is read before this point
                v
  [ Extension reads the focused field's text ]
                |
                v
  [ HTTPS request to the One Shot Fix backend API ]
                |
                | service providers may be involved
                | in operating the correction feature
                v
  [ Correction is produced ]
                |
                v
  [ Corrected text returned to the extension ]
                |
                v
  [ Popup shows you the corrected text ]
                |
                | you decide
                v
  [ You click Apply ]  --->  field is overwritten
                                 (no undo)

The Network tab test

This is the single most valuable thing in the article, because it produces evidence rather than opinions and it works on any extension in any browser.

1. 1

   Open a page with a plain text field

   Any page. A blank email draft works well because you control what goes in it.

2. 2

   Open DevTools and switch to the Network tab

   F12 in Chrome, Edge and Firefox on Windows. Click Network. Leave it open and empty.

3. 3

   Type something distinctive, and do not touch the extension

   Use a token you can search for, like zebraquartz-4417. Type a full sentence containing it. Now look at the Network tab.

   If requests fire while you type, that is a continuous capture model. Check whether your token appears in any request payload. This is the test that separates a tool from a recorder, and most people never run it.

4. 4

   Clear the log, then click the extension's icon

   Now a request should appear. Click it and read the Headers and Payload tabs. You should see your own text going to a specific host.

5. 5

   Note the host

   Is it the vendor's own domain, or a third-party model provider? Both are legitimate architectures. What is not legitimate is a privacy page that names one while the traffic goes to the other.

6. 6

   Filter by your token to check for extras

   Use the Network tab's filter box to search for zebraquartz-4417. Every request containing it is a request that carried your text. If there is more than one, you now know.

Two caveats so you do not draw the wrong conclusion. Some extensions batch or debounce, so a request may appear a few seconds after typing rather than with each keystroke — watch for a beat before concluding. And some traffic goes through a service worker, which the Network tab does show, but if you see nothing at all while the extension visibly works, check that you are looking at the right frame in a page with iframes.

Auditing permissions yourself

Three places to look, in each browser. None of this requires reading source code.

There is also a fourth place, which is the store listing. The Chrome Web Store and Firefox Add-ons both publish a privacy or data-use section where the developer declares what the extension collects. These declarations are self-reported, so treat them as a claim to check against the Network tab rather than as a finding.

What the common permissions actually grant

Set site access to 'On click'

If you take one action after reading this, take this one. It converts a broad capability into a narrow one without uninstalling anything, and it works on any extension in Chrome and Edge.

Open the extension's Details page, find Site access, and choose 'When you click the extension' instead of 'On all sites'. The extension's code can then only run on a page after you have invoked it there. Background scripts and content scripts that would otherwise be present on every page you visit are not injected until you act.

The trade-off is real but small: you click the icon to activate it on each new site, and on some sites an extension that relies on being loaded at page start may need a reload after you first click it. For a correction tool that is invoked deliberately anyway, that is almost no cost at all.

Firefox does the same thing differently. Its default is stricter — an extension with optional host permissions asks for access at run time, per site — and you can remove access for individual sites from the Permissions tab. Firefox also lets you set an extension to run only when you click it, or only in private windows, or not in private windows at all.

The other half: what you put in the field

Permissions control what an extension can reach. They do not control what you hand it. The most common privacy mistake with a writing tool is not installing the wrong extension — it is correcting a field that contains more than the sentence you cared about.

Red flags worth acting on

• Requests fire before you invoke the extension. That is a continuous capture model, whatever the privacy page says.
• The privacy policy names one processor while the Network tab shows traffic to a different host.
• 'Local processing' or 'your text never leaves your device' alongside correction quality that requires a large model. The claim and the capability are incompatible.
• history, bookmarks, cookies, webRequest or nativeMessaging permissions on a writing tool.
• A retention section that is shorter than the marketing section, or that answers 'do you sell data' without answering 'how long do you keep it'.
• No named contact for data questions, or a support address that has never replied.
• A store listing with no privacy tab filled in at all. Both major stores require one; an empty declaration is a choice.
• The extension updated recently and the permissions changed without a note. Re-check the Details page after any update, not only at install.

Where One Shot Fix stands

Stated plainly, including the parts that are less flattering, because a privacy summary that only lists the good items is not a summary.

Where this breaks down

Read the policy, then run the test

Frequently asked questions