Full Page PDF Snap → PDF extension permissions

The 30-second check

You do not need any tools. Every listing on addons.mozilla.org has a “Permissions and data” section near the bottom. What matters is one distinction:

• “Access your data for all websites” — the extension may read every page you visit, at any time, whether or not you asked it to do anything.
• “Access your data for the current website” or nothing at all — the extension only sees a page when you actively start it there.

A named domain in that list is even more telling. If an extension declares access to https://example-converter.com/, it talks to that server. That is not a suspicion; it is what the declaration is for.

If you want to be sure rather than probable

Permissions describe what is possible. To see what actually happens, watch the traffic:

1. Open about:debugging → This Firefox
2. Find the extension, click "Inspect"
3. Switch to the Network tab
4. Run a capture and watch what appears

An extension that works locally shows nothing there. One that converts server-side shows the upload. This is the only method that gives certainty, and it takes about two minutes.

What the current extensions declare

Pulled from the Mozilla add-ons API on 1 August 2026. The “declared hosts” column lists exactly what each extension states in its own manifest — no interpretation:

The consequence nobody mentions: logged-in pages

This is where the two designs stop being a matter of taste. A server-side converter receives a URL and fetches the page itself — as an anonymous visitor. It has no access to your session. The provider of “Save as PDF” states this openly in its own listing:

“Please note that for security reasons, it is not possible to create PDFs from pages that require a login, such as your webmail inbox, online banking, shopping cart contents, payment […]”
— Save as PDF, own listing description, retrieved 1 August 2026

That is a fair and transparent statement, and it deserves credit rather than criticism. But it defines the boundary precisely: the documents people most often want to keep — an order confirmation, an invoice in a customer portal, insurance correspondence, a booking record, a support conversation — are exactly the ones behind a login.

An extension that renders locally has no such limit, because it captures what your browser already shows. That is a functional difference, not a moral one. Which side you want depends on what you archive.

Reading a manifest yourself

For a technically inclined reader, there is a faster route than any listing page. The same API this article uses is public:

curl -s "https://addons.mozilla.org/api/v5/addons/addon/SLUG/?lang=en-US" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); \
    print(d['current_version']['file']['permissions'])"

Replace SLUG with the part of the listing URL after /addon/. Anything containing :// or <all_urls> is a host permission. This is also how the table above was produced — so you can reproduce it, and correct it if something has changed.