Is Tampermonkey Safe? Permissions, Privacy and Ownership Checked

Can Tampermonkey be trusted?

The Tampermonkey extension itself can be trusted about as far as any mature, single-developer tool with broad permissions: it has been maintained for many years, it is the best-known userscript manager for Chrome, and it is distributed through the official Chrome Web Store. What it cannot do is vouch for the scripts you feed it.

Tampermonkey was created by Jan Biniok and is published at tampermonkey.net. It is a manager, not a feature: on its own it changes nothing about the pages you visit. Every visible effect comes from a userscript, a small JavaScript file written by someone else (or you) that Tampermonkey injects into matching pages.

That split is the key to every safety question. Tampermonkey is trusted infrastructure with access to every site. A userscript is untrusted code that borrows that access. A safe Tampermonkey setup is really a safe script-selection habit plus a few settings that stop a bad script from reaching further than it needs to.

If you want the listing, current version and our editorial notes in one place, see the Tampermonkey profile. It sits in our developer tools category because writing and debugging scripts is its main audience, even though plenty of non-developers use it to tweak sites.

What permissions does Tampermonkey ask for in Chrome?

The current Manifest V3 build (version 5.5.0) declares 17 permission entries, host access to <all_urls>, and one optional permission, downloads. Almost all of them exist so userscripts can do what the old Greasemonkey API promised: run on any page, make requests, store data and show notifications.

Notice what is missing: there is no history permission, so Tampermonkey cannot read your full browsing history list, and clipboard access is write-only. That is a narrower footprint than some ad blockers and shopping extensions. Compare it with other tools in our permissions guide.

Why does a userscript manager need access to every site?

Because Tampermonkey cannot know in advance where your scripts will run. A script's @match or @include lines decide its sites, and they can name any domain, so the manager requests all of them up front rather than prompting on every install.

The powerful part is not page access alone but the network and cookie permissions. A script granted GM_xmlhttpRequest can send requests to other domains without the usual browser cross-origin limits, which is how scripts fetch data from APIs. Tampermonkey gates this with the @connect header: a script should list the domains it talks to, and Tampermonkey asks you before it contacts anything unlisted.

That confirmation prompt is one of your best safety signals. If a script that restyles a news site suddenly wants to connect to an unfamiliar domain, deny it and read the code. Legitimate scripts usually explain every @connect entry in their description.

• Page access lets a script read what you type on that page, including passwords in login forms, if it runs there.
• Cross-origin requests let a script send what it read to a server of its choosing, once allowed.
• Cookie access through GM_cookie can expose session cookies, which are as good as a logged-in password.
• Auto-updates mean a script that is harmless today can change tomorrow if the author's account is taken over or sold.

Is Tampermonkey open source, and what happens to your data?

No, current Tampermonkey releases are closed source. Early versions were published openly, but later versions moved to a proprietary licence, and the public GitHub repository is mainly used for issue tracking. That is the root of most privacy-forum criticism: you cannot audit exactly what the extension does.

Closed source is not the same as unsafe. Chrome Web Store extensions still ship readable JavaScript, and the manifest shows exactly which permissions it can use. What you lose is easy independent review and the ability to build it yourself. If that matters to you, Violentmonkey is the open-source alternative covered below.

Your scripts and their stored values live in the extension's local storage on your machine. Sync is optional: you can choose browser sync or connect a cloud account such as Google Drive, Dropbox, OneDrive or a WebDAV server from the dashboard's settings. Read the current wording on the Tampermonkey privacy policy page before enabling any sync, because policies change.

Stored locally

Installed scripts, their settings and anything a script saves with GM_setValue.

Sent to script sources

Update checks hit each script's @updateURL, typically Greasy Fork or GitHub, which reveals which scripts you use to that host.

Sent to your sync provider

Only if you turn sync on, and only to the provider you pick.

Sent by scripts

Whatever a script sends through GM_xmlhttpRequest after you allow its @connect domains. This is where leaks actually happen.

Is Tampermonkey a virus, or are the scripts the risk?

Tampermonkey is not a virus, but it can run one-page malware if you install a malicious script. Antivirus tools occasionally flag it because it injects code into pages, which is exactly what harmful extensions do, so a warning alone is not evidence of infection.

The genuine danger signs are different. Unsafe Chrome extensions do exist, and copycat listings sometimes borrow popular names. Always check the Web Store ID matches the official one, and install from the link on tampermonkey.net rather than a search result or a site that bundles it with a download.

For scripts, treat each install like installing a small extension. Before you click Install on Greasy Fork or OpenUserJS, open the code tab and scan it for these red flags:

• @match *://*/* or @include * on a script that should only touch one site.
• @grant GM_cookie or GM_xmlhttpRequest on a purely cosmetic script.
• @connect * or unexplained third-party domains.
• @require lines loading code from URLs you do not recognise, which bypasses whatever you reviewed.
• Minified or obfuscated blocks, eval(), or strings built from character codes.
• A brand-new author account, few installs and a promise of free premium features or game advantages.

If a script passes that scan, it is still worth pinning trust to authors who keep public source on GitHub, because you can see every change before an update lands.

How do you lock down Tampermonkey in Chrome?

Limit where Tampermonkey runs, control updates and exclude sensitive sites. Chrome's own site-access control works on top of Tampermonkey's settings, so a script cannot run where Chrome has not granted access.

1. Open chrome://extensions, find Tampermonkey and click Details.
2. Under Site access, switch from On all sites to On specific sites and add only the domains your scripts target. On click also works if you run scripts occasionally.
3. On the same page, check the Allow User Scripts toggle: recent Chrome versions require it for Manifest V3 userscript managers. Older builds used Developer mode in the top-right corner instead.
4. Click the Tampermonkey icon, choose Dashboard, then the Settings tab, and set Config mode to Advanced to reveal every option.
5. In the Security section, review how scripts may access cookies and how @connect requests are confirmed; stricter choices mean more prompts but fewer surprises.
6. Under Script Update, lengthen the check interval or disable automatic updates for scripts you have reviewed, then update them by hand from the Installed Userscripts tab.
7. Use the global exclude list to block all scripts on banking, email and work admin domains, for example https://*.yourbank.com/*.

Setting labels shift slightly between Tampermonkey versions, so if an option is missing, confirm Config mode is on Advanced before assuming it was removed.

Should you use Tampermonkey or Violentmonkey?

Choose Violentmonkey if you want open-source code you can audit; choose Tampermonkey if you need the widest script compatibility and built-in cloud sync options. Both are safe managers; neither makes a bad script safe.

Do not run both at once. Two managers can inject the same script twice and double the number of extensions with all-site access. If you switch, export from one and import into the other. Violentmonkey's official site is violentmonkey.github.io.

Greasemonkey, the original, is a Firefox add-on, so it is not an option for Chrome users.

Is Tampermonkey safe for GeoGuessr and game scripts?

Tampermonkey is technically safe for game scripts, but your account may not be. Scripts that reveal locations or automate play in GeoGuessr and similar games can break the game's terms and lead to bans, and cheat scripts are a favourite hiding place for code that grabs session cookies.

Stick to cosmetic or accessibility scripts from authors with public source, restrict Tampermonkey's site access to the game's domain, and never enter payment details while a game script is active.

Often the safest userscript is no userscript. Many popular scripts replicate what a focused, reviewed extension already does with a narrower job. Swapping them out removes one more stranger's code from your pages.

Browse more vetted options in Chrome extensions for developers and the security and privacy category.

How do you get rid of Tampermonkey completely?

Export your scripts first, then remove the extension from Chrome's extensions page. Removing it deletes its local storage, so any script settings are gone unless you backed them up.

1. Click the Tampermonkey icon and open Dashboard.
2. Go to the Utilities tab and use Export to save a zip of all scripts and their settings.
3. Open chrome://extensions, find Tampermonkey and click Remove, then confirm. Alternatively, click the puzzle-piece Extensions icon, the three-dot menu next to Tampermonkey, and choose Remove from Chrome.
4. If you used cloud sync, delete the Tampermonkey folder from Google Drive, Dropbox or OneDrive so the backup does not linger.
5. Sign out and back in to any site where a script had cookie access, which rotates your session.
6. If Tampermonkey reappears after removal, check chrome://management for a policy installing it, and scan for software that bundled it.

Chrome on Android and iPhone does not run desktop extensions, so there is nothing to remove there. On Windows, Mac, Linux and ChromeOS the steps above are identical. Our review methodology explains how we weigh permissions like these, and the blog has safety checks for other popular extensions.