First, who is writing this
I make one of these extensions. This page lives on the site of Turn It Up, Son!, a free volume booster for Chrome. So read everything below knowing I am not a neutral party.
I am writing it anyway, because the useful version of this article is not "trust me". It is a set of checks you can run on any booster, including mine. If they lead you somewhere else, that is a fine outcome.
What a booster actually needs in order to work
There is no way to make a browser tab louder without touching that tab's audio. The sound has to be picked up, amplified and played back out. So an extension that asks for nothing at all is not being polite, it is impossible.
That means "it asks for permissions" is not by itself a warning sign. The real question is not whether it asks, but which permissions, and when.
A booster has a reasonable case for capturing tab audio, for seeing which tabs are making sound so it can list them, and for saving your settings. Those are all tied to the job.
The permission worth thinking about
The one that deserves a pause is broad access to every website you visit, granted permanently at install time. In the browser prompt it reads as something close to "read and change all your data on all websites".
That permission lets the extension run its own code on every page you open. In an honest extension it might be there to control a video player. In a dishonest one, the same access is what would allow it to read whatever is on the page, including things that have nothing to do with audio.
Audio processing itself does not require it. Some features around the edges do, like changing playback speed, because that means driving the page's own player. The healthy pattern is an extension that asks for site access only when you switch such a feature on, for that site, and gives it back when you switch the feature off.
To be fair about it: broad access is not proof of bad intent, and plenty of legitimate extensions need it. It just raises the amount of trust being asked for, so it should be earned rather than clicked through.
A checklist you can use on any extension
Five minutes on the store page will tell you most of what you need. This works for boosters, and for everything else you install.
- Read the permission list on the store page, then the browser's own prompt when you click install. That is the actual contract. If it mentions access to all sites, ask what a volume slider would need that for.
- Check whether the source code is public. Public code is not a guarantee that nobody looks at it, but it does mean anyone can, and a developer with something to hide rarely invites that.
- Look for a real privacy policy, one that names what is collected and what is sent where. A page of generic legal filler that never mentions the extension is a non-answer.
- See whether access is requested up front or on demand. An extension that stays quiet until you enable the feature that needs it is showing you how it thinks.
- Check whether it recently changed hands. A popular extension is valuable to buy precisely because it already has permission on a lot of machines, and behaviour can change after a sale while the old reviews stay.
- Read the recent reviews, not the average. An old average describes a version nobody is running. Sort by newest and look for people describing behaviour.
- Ask whether it needs an account. A local audio tool asking you to sign in is worth a question, because it attaches your usage to an identity somewhere.
General hygiene helps more than any single check. Install fewer extensions than you are tempted to, read the prompt instead of clicking past it, and go through your list every few months to remove the ones you stopped using. An unused extension keeps its permissions.
How this one answers each point
Having handed you a checklist, it is only fair to run mine through it.
- Permissions. Four, and each has a job: storage to keep your settings, tabCapture to process the tab's audio, tabs to list which tabs are playing something, offscreen to run the audio engine in the background.
- Site access. Not requested at install. It is asked for only when you turn on playback speed, auto skip or YouTube auto-continue, only for the site involved, and it is handed back when you turn that feature off. By default the extension sits under "No access needed" in the browser's extensions menu, and it leaves no code on any page while nothing is enabled.
- Source code. Public on GitHub. You can read exactly what the four permissions are used for.
- Where settings live. In the browser's local extension storage on your own machine. Synced storage is not used, so nothing travels to a Google account. There is a button in the settings that wipes all of it.
- Network requests. Two kinds, both optional. Pasting a song link into the auto skip list sends only that link to the public track info endpoint of YouTube, Spotify or SoundCloud, to fetch the title. Feedback you choose to send from the uninstall page or the bug report box goes to a Google Form. No telemetry, no usage reporting.
- Accounts and tracking. None. No analytics, no ads, no tracking. Audio is processed live as it plays and is never recorded, stored or transmitted.
Do not take my word for it. Every item above is checkable against the store listing, the browser's permission screen and the code.
The risk that has nothing to do with privacy
There is a second kind of safety here, and it gets ignored because it is less dramatic.
Pushing audio well above 100% can distort it. A limiter, which this extension has, catches the crackle and keeps loud playback clean. What a limiter does not do is protect you. Clean sound at a dangerous volume is still a dangerous volume.
Loud playback over long stretches can damage hearing permanently, and headphones put all of it right against your ears. Boost is genuinely useful for a quiet recording or a badly mixed lecture. It is a poor way to listen to music for three hours. Use the boost you need, then bring it back down.
So, are they safe?
Some are, some are not, and the difference is visible before you install if you spend five minutes looking. Judge the permissions, whether the code is open, and whether access is asked for only when a feature needs it.
If Turn It Up, Son! holds up against that checklist for you, it is free and runs in Chrome, Edge and Brave. If it does not, use the checklist on whatever you install instead. That was the point of the page.