Install Chrome Extensions From Outside the Web Store

Yes, you can install Chrome extensions from outside the Chrome Web Store, but the process is no longer a simple toggle. Google has progressively locked down sideloading for security reasons, so the method that works depends on whether you use Windows, Mac, Linux, or ChromeOS, and whether you are testing a developer extension or installing a third-party file. This guide explains the current options, the risks, and the exact steps for each scenario.

Why Google Blocks Sideloading

Chrome extensions have deep access to browser data, passwords, and active tabs. A malicious extension can read everything you type on a page, redirect payments, or inject ads. Google’s Chrome Web Store is not perfect, but it provides automated scanning, user reviews, and a takedown process. Sideloading bypasses all of that, so Google has made it deliberately difficult to discourage casual users from installing unvetted code.

In 2018, Google removed the “Load unpacked” option from the regular extensions page for most users. That change forced Windows and Mac users to use Developer Mode, which is still available but comes with a warning that Google will disable the extension if it detects it was installed outside the store. The policy is stricter on ChromeOS, where sideloading is only allowed on developer channels.

Method 1: Developer Mode (Windows, Mac, Linux)

This is the only official way to install an extension from a .crx file or an unpacked folder on a standard desktop Chrome installation. It works because Google still allows developers to test their own extensions before publishing.

Download the extension file. If it is a .crx file, rename it to .zip and extract it to a folder. If it is already a folder with files like manifest.json, keep it as is.
Open Chrome and go to chrome://extensions.
In the top-right corner, turn on Developer mode.
Click Load unpacked in the top-left.
Select the folder containing the manifest.json file.
The extension appears in your list. It will be disabled automatically if you restart Chrome and Google flags it as unverified.

This method works for extensions you have downloaded from GitHub, from a developer’s website, or from a trusted colleague. It does not work for .crx files that are not unpacked first, because Chrome removed drag-and-drop installation years ago.

Method 2: Chrome for Developers (ChromeOS)

ChromeOS is locked down by design. Sideloading is not available on stable or beta channels. To install an extension from outside the store on a Chromebook, you must switch to the Chrome for Developers channel, which is a more unstable build that receives nightly updates.

Go to chrome://version and note your current channel.
Go to chrome://settings/help and click More details.
Select Change channel and choose Chrome for Developers.
Chrome will download the update and restart.
Once on the developer channel, go to chrome://extensions, enable Developer mode, and use Load unpacked as described above.

This is not recommended for daily use. Developer channel builds can have bugs, and Google may break compatibility with your existing extensions. You also cannot switch back to stable without doing a full reset of your Chromebook.

Method 3: Enterprise Policy (Windows, Mac, Linux)

Organizations can sideload extensions for all users through Group Policy (Windows) or a managed configuration file (Mac and Linux). This is how companies distribute internal tools that are not on the Web Store. It requires administrative access to the computer and a policy file that lists the extension’s ID and update URL.

For a single user, this is overkill. The policy method is designed for IT departments, not individuals. If you try to use it without proper administrative rights, Chrome will simply ignore the policy.

How to Choose a Safe Extension File

If you decide to sideload, the source matters more than anything. A .crx file from a random forum is a gamble. The safest sources are:

Official developer sites that link to their own GitHub repository or a direct download page.
GitHub repositories with a clear license, recent commits, and a manifest.json that you can read.
Your own code if you are a developer testing a personal project.

Before loading any extension, open the folder and look at the manifest.json file. Check the permissions field. An extension that asks for access to all websites, your browsing history, and your clipboard is a red flag. A calculator extension should not need network access.

Common Problems and Fixes

The most frequent issue is that Chrome disables the extension after a restart. This is a security feature, not a bug. To re-enable it, you have to go back to chrome://extensions, turn on Developer mode, and click Load unpacked again. There is no way to make Chrome ignore the warning permanently on a standard install.

Another common problem is a manifest.json error. Chrome updates its manifest format over time. If you are loading an older extension, it may use manifest version 2, which is deprecated. You will see an error like “Manifest version 2 is not supported.” The only fix is to find a newer version of the extension or update the manifest yourself, which requires basic coding knowledge.

If the extension loads but does nothing, check the console. Right-click the extension icon, select Inspect popup or Inspect service worker, and look for JavaScript errors. Often the extension was written for an older Chrome version and uses APIs that have been removed.

Alternatives to Sideloading

If the extension you want is not on the Web Store, consider these options before sideloading:

Use a different browser that allows sideloading more freely, such as Firefox or Edge. Edge has a similar policy to Chrome, but Firefox allows you to install temporary extensions easily and does not disable them on restart.
Ask the developer to publish it on the Chrome Web Store. Many developers offer a store version and a GitHub version. The store version is always safer.
Use a userscript with Tampermonkey or Violentmonkey. If the extension is essentially a script that modifies page behavior, a userscript can do the same thing without the security risks of a full extension.
Recreate the functionality with a bookmarklet or a small local script. For simple tasks like text formatting or link extraction, this is often easier and safer.

Security Risks You Should Know

Sideloaded extensions are not scanned by Google. They can contain malware that steals passwords, injects ads, or mines cryptocurrency. Even if the extension is open source, the version you download might be modified by a third party. Always compare the file hash with the one published by the developer, if available.

Another risk is that the extension can update itself. If the extension’s update URL points to a compromised server, the developer’s account could be hacked, and a malicious update could be pushed to your browser. The Web Store mitigates this by hosting updates on Google’s servers. Sideloaded extensions do not have that protection.

Finally, sideloaded extensions can be used to track your browsing habits. Even a well-intentioned extension might send analytics data to a third-party server. Read the privacy policy, if one exists, and check the code for any fetch or XMLHttpRequest calls to unknown domains.

Frequently Asked Questions

Why does Chrome keep disabling my sideloaded extension?

Chrome automatically disables any extension that was loaded via Developer mode if it is not on the Web Store. This is a protective measure. You can re-enable it by going to chrome://extensions, turning on Developer mode, and clicking Load unpacked again. There is no permanent fix on a standard install; you have to repeat this every time Chrome restarts.

Can I install a .crx file by dragging it into Chrome?

No. Google removed drag-and-drop installation in 2018. You must rename the .crx file to .zip, extract it, and then use Load unpacked in Developer mode. This is a deliberate security change to prevent users from accidentally installing malicious files.

Is it legal to sideload extensions?

Yes, it is legal for personal use. The Chrome Web Store’s terms of service apply to the store itself, not to the browser. However, if you distribute a sideloaded extension that includes copyrighted code without permission, that could be a legal issue. Sideloading for your own use is generally fine.

Will sideloading void my Chrome warranty?

Chrome does not have a warranty in the traditional sense. However, sideloading can cause instability, and if you break your browser profile, you may have to reset it. Google does not provide support for sideloaded extensions, so you are on your own if something goes wrong.

Can I sideload extensions on Chrome for Android?

No. Chrome for Android does not support extensions at all. You can only use extensions in the desktop version of Chrome. On Android, you can use Kiwi Browser or Firefox for Android, which support extensions, but those are separate browsers, not Chrome.

What is the difference between Developer mode and Enterprise policy?

Developer mode is for individual users testing extensions. Enterprise policy is for organizations that want to force-install extensions on all managed devices. Enterprise policy does not show the “disable” warning, but it requires administrative control over the device and a policy file. For a single user, Developer mode is the simpler option.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →