torwacheChrome Web Storesoon
Guides & comparisons

Technical guide

Why use an open-source website blocker?

Open source does not magically make an extension trustworthy. It does make important claims inspectable: what permissions are declared, where the list is stored, and whether anything is sent away.

Fact-checked August 24, 2026

Four privacy claims source code can support

Requested permissions
The manifest lists the browser capabilities the extension asks Chrome to grant.
Network requests
You can search for request clients, remote endpoints, telemetry libraries, and update services.
Storage location
You can see whether the blocklist uses local storage, browser sync, or an external account.
Page access
Content scripts and host permissions reveal whether code can run inside visited websites.

A public repository is not the whole trust chain

Source availability does not automatically prove that a store package was built from that exact revision. Large projects may also be technically open while remaining difficult to audit because the shipped bundle is generated, minified, or dependent on remote services.

Prefer small projects with reproducible packaging, readable release notes, few runtime dependencies, and a manifest that matches the store permission prompt.

A five-minute browser-extension audit

  1. 1

    Open the manifest

    Read the permissions and host permissions first.

  2. 2

    Search for network APIs

    Look for fetch, XMLHttpRequest, WebSocket, telemetry, and remote URLs.

  3. 3

    Find the storage calls

    Confirm whether data is stored locally, synchronized, or sent to a backend.

  4. 4

    Check content scripts

    Understand which websites can run extension code and what that code reads.

  5. 5

    Compare the package

    Look for a documented build or packaging command and inspect the release artifact.

Why torwache is intentionally easy to inspect

The extension is plain JavaScript without a runtime framework or production bundler. Its blocklist, rule generation, navigation guard, and blocked page live in separate readable modules. The packaging script copies the reviewed files into a release archive.

You can read the repository, inspect themanifest, ordownload a release. The point is not “trust us because open source.” The point is that you do not have to.