Every other inspector asks to read and change your data on all websites: your staging environments, your internal dashboards, anything you are logged into. None of them can show you what they do with it. This one asks for nothing, and you can check.
An inspector runs on whatever you have open. The question is what it is allowed to do there once you have closed the panel, and whether you have any way of finding out.
The manifest declares activeTab and scripting, and no host
permissions at all. activeTab is granted by your click, for one tab, and
revoked by the browser the moment you navigate away.
The standard ask in this category, and a reasonable one for some of what they do. The difficulty is that all of them are closed source, so the permission is the last thing you can verify about them.
Three steps, and the third is the one that matters: nothing survives the session, because nothing was ever stored.
Click the toolbar button or press AltShiftI. That gesture is what grants access, to that one tab. Before it, the extension cannot see the page at all.
Hover to read, click to hold, arrow keys to walk the tree. Values are editable and every change is listed with what it was before.
Closing reverts every edit and removes the style attribute it created.
Navigating away revokes the grant on its own. Nothing was written down.
Seven panels, in the order the tabs run. The two in the middle are the ones nothing else in this category offers.
Everything the cascade decided, and the chance to argue with it. Values are editable, and every edit is exactly revertible.
Open Inspector
:hover, :focus and five more
Whether anyone can actually read it, not just what the colour is. Live WCAG grading, and an audit of every failing sample on the page.
The font that rendered, not the font that was asked for. Measured on a canvas, because the stack is only a request.
How the page is built, which nothing else in this category reports. Grid and flex anatomy, and the spacing scale it really follows.
What the page actually loaded, with thumbnails, because a list of twelve files called icon.svg identifies nothing.
srcset candidate the browser really chose
Source you could paste, rather than a recording of the live DOM. Framework bookkeeping is stripped on the way out.
The page's design system, in whatever format the next step needs, including one written for a coding assistant.
The arrow keys are the part worth knowing. A wrapper with no padding of its own is entirely covered by its children and cannot be clicked at all, and stepping the tree is the only way to reach it.
The three established tools are good, and two of them do things this one does not. The difference is what they ask for, and whether you can check.
| Open Inspector | CSS Peeper | Hoverify | |
|---|---|---|---|
| Site access requested | none | all sites | all sites |
| Source you can read | MIT | closed | closed |
| Price | free | $2.49–5.99/mo | $30/yr · $89 |
| Works offline, always | yes | account | licence check |
| Layout anatomy & spacing scale | yes | no | no |
| Design token export | 6 formats | no | no |
| Page-wide contrast audit | yes | paid tier | yes |
| Screenshots & capture | no | no | yes |
| Multi-device preview | real window | no | 33 at once |
| SEO & tech-stack tools | no | no | yes |
Read from their own pricing and feature pages, and current as of August 2026. If any of it has gone stale, tell us and it will be corrected. A comparison that overstates a rival's weakness would undermine the only thing this project is actually selling.
Every claim on this page is checked by something that fails the build when it stops being true. That is the point of the project; a promise in a readme is worth very little.
Chrome's own install screen says so. The manifest has no host_permissions
key.
No fetch, XHR, WebSocket or beacon, scanned across source, both manifests and the shipped bundles on every build.
908 unit and 38 end-to-end, the latter driving the real packaged extension in a real browser.
The panel grades other pages, so it is held to the same standard in both themes, by a test that measures the real cascade.
A tool whose pitch is honesty cannot hide its own constraints. One of these is a decision rather than a gap, and it is marked as such.
No screenshots, console or network debugging. Those are separate products, and building them is not obviously the right move for this one.
Cross-origin stylesheets cannot be read. True for every extension. .cssRules throws, and the restriction follows the stylesheet rather than
the reader. The panel says so instead of reporting "no rules matched".
The responsive preview has a floor. It moves the real window so media queries genuinely re-evaluate, but no window goes below the operating system's minimum, about 500px on macOS. The panel reports the width it actually got.
No bulk asset download. Zipping every asset means fetching every asset, which
would break the only promise here that matters. The Assets tab hands you the URL list
for curl instead.
Mostly the sceptical ones, because those are the ones that matter for a tool that runs on pages you did not write.
It has to be. A paid tier needs a licence check, a licence check is a network request, and a network request would break the only promise this extension makes. The constraint is real and it is the reason you can trust the claim.
Chrome also shut down its own payments system in 2021, so charging would mean running a payment processor and a licence server. There is a "buy me a coffee" link in the panel footer and that is the entire business model.
Read scripts/check-zero-egress.mjs. It scans the source, both generated
manifests and the shipped bundles for fetch,
XMLHttpRequest, WebSocket and sendBeacon, and
fails the build when it finds one. It runs on every build, so the guarantee cannot
quietly lapse.
Or read all of it. It is MIT, and that is rather the point, because the other three tools in this category are closed source, so their permission is the last thing you can verify about them.
DevTools tells you what one element computes to. This tells you how the page is built: the spacing scale it follows, the type scale behind its headings, its real palette, the breakpoints that affect what you are looking at, and hands you the result as design tokens.
It is also considerably faster for the small questions. Hovering to see a font is one gesture rather than four.
That was the design constraint. Every edit records the element's prior inline value
and its !important state, so reverting restores exactly what
was there, including a page's own inline styles that a blanket reset would
destroy.
Closing the inspector reverts everything and removes the style
attribute it created, down to not leaving an empty style="" behind. A
reload would discard the edits anyway; leaving marks on a page we were asked only to
read would not be acceptable.
It says so, and says why. Cross-origin stylesheets throw on
.cssRules for every extension, because the restriction follows the
stylesheet rather than the reader, so Matched Rules reports "3 stylesheets are served
cross-origin" instead of "no rules matched".
Contrast against a gradient is reported as indeterminate rather than guessed. A custom element that rendered something but exposes no children is flagged as probably hiding a closed shadow root, described as the heuristic it is.
Yes. Manifest V3, minimum version 115. The screen eyedropper is the one exception: that API is Chromium-only, so the control hides itself rather than failing when pressed.
It is the one in this category that has a chance. Chrome's install screen shows no
site access requested, the manifest has no host_permissions key, and
the source is readable. Point them at the repository.
Chrome Web Store review is in progress. Until it clears, building it yourself takes two commands and gives you the same artifact.
Any Chromium browser. One click, and it asks for no site access.
Add to ChromeManifest V3, minimum version 115. Everything works except the eyedropper, which needs an API Firefox does not have.
Once the repository is public: clone it, then load
.output/chrome-mv3 as an unpacked extension.
pnpm install
pnpm buildIt is the shortest true sentence about this project, and the only one the other three cannot write. Everything else here is a consequence of it.