Quick answer
A Manifest V3 validator checks a Chrome extension's manifest.json against the rules Chrome and the Chrome Web Store enforce. Paste yours into Playxoft's free Manifest V3 Validator for JSON errors with line and column, MV3 mistakes such as browser_action, background scripts or a string content_security_policy, invalid match patterns, the exact install warnings users will see, and a store review risk summary. Everything runs in your browser.
- Errors by line and column
- Manifest V3 rules
- Match pattern checks
- Install warning preview
- Store review risk
- Copy the report
How to use the Manifest V3 Validator
- 1Paste your manifest.json, drop the file on the editor, or click Open.
- 2Fix the errors first: each one shows its line and column, and clicking it jumps there in the editor.
- 3Review the warnings: Chrome loads the extension, but something is off or risky.
- 4Check Install warnings to see exactly what Chrome will ask users to accept.
- 5Read the Store review risk summary, then copy the report for your team or pull request.
Why does Chrome say "Manifest is not valid JSON"?
Chrome reads manifest.json with its own JSON parser. It is stricter than JavaScript in some ways and looser in one:
- Trailing commas are rejected.
"version": "1.0",before a closing}stops the extension from loading. - Comments are accepted. Chrome allows
//and/* */comments, but JSON.parse, many build tools and linters reject them, so the validator warns. - Keys and strings need double quotes. Single quotes and unquoted keys are errors.
{
"manifest_version": 3,
"name": "My extension",
"version": "1.0",
}The validator reports the comma after "1.0" on line 4 and tells you to remove it. For general JSON problems, the JSON validator explains every syntax error in detail.
What does the Manifest V3 validator check?
Errors are things Chrome refuses, the Chrome Web Store rejects, or Chrome silently ignores so a feature never works:
| Check | What happens in Chrome |
|---|---|
manifest_version 2 | No longer runs anywhere |
browser_action, page_action | Ignored in Manifest V3; use action |
background.scripts or page | Ignored; use one service_worker file |
Host patterns in permissions | Ignored; move them to host_permissions |
web_accessible_resources as strings | Invalid; each entry is an object |
content_security_policy as a string | Invalid; it's an object |
'unsafe-eval' or a CDN in extension_pages | Install fails |
| Bad match pattern in a content script | Install fails |
Version 1.0-beta, 1.032 or 0.0 | Install fails |
Warnings cover unknown keys and permissions (with "did you mean" suggestions), permissions that can't be optional, missing icon sizes, broad host access, invalid shortcuts and description length.
How do match patterns work in Chrome extensions?
A match pattern is <scheme>://<host><path>, or the special value <all_urls>. The scheme is http, https, file or * (which means http and https). A * in the host must come first and be followed by a dot, or stand alone.
| Pattern | Valid? | Why |
|---|---|---|
https://*.example.com/* | Yes | example.com and every subdomain |
*://mail.google.com/* | Yes | http and https |
http://localhost/* | Yes | Any port, unless one is given |
file:///docs/* | Yes | Needs the user to allow file access |
https://example.com | No | Missing the path, add /* |
https://google.*/* | No | Top-level wildcards aren't supported |
ftp://example.com/* | No | Unsupported scheme |
Chrome ignores the path in host permissions, and web_accessible_resources patterns must end in /*. See Chrome's match pattern guide. To test patterns against real URLs in bulk, the regex tester helps.
What makes Chrome Web Store review take longer?
Google says most reviews finish within a few days but can take up to a few weeks, and names what slows them down:
- Broad host permissions.
*://*/*,https://*/*and<all_urls>give access to everything a user does on the web. - Sensitive permissions. Some, like
tabsanddownloads, grant data access directly; others, likecookiesandwebRequest, do with host permissions. Reviewers check each is necessary. - Lots of code, or code that's hard to read. Obfuscation is not allowed; minification is, but makes review harder.
The validator's risk summary flags these, and credits what helps: activeTab, optional permissions and narrow host lists. If the extension handles user data, you also need a privacy policy; the Chrome extension privacy policy generator writes one. Details are in Google's review process page.
Frequently asked questions
Last updated by the Playxoft engineering team.