Are Zotero plugins safe?

What the grades mean

• A or A+ (786)Nothing in the code is more than a low concern. An A+ also behaved as described when we ran it in Zotero 10 (179 plugins).
• B (669)At least one finding is worth reading before you install. It isn't a verdict that the plugin is unsafe: for 257 of them, the only finding is two zotero:// links added by a library the plugin is built with.
• C (76)We found something serious, such as code scrambled so nobody can check it.

15 more aren't graded yet.

What a plugin can do

Among the 1,546 plugins we list, 909 work with files on your computer, 926 contact servers on the internet, and 257 can launch other programs. Most do it because that's their job: a translation plugin has to reach a translation service. Our checks show which plugins do what, and where your data goes.

What we check

We download each plugin's latest release and read its code. Three things set the grade: whether the code can be read, where your data goes, and what powerful capabilities it uses. The single worst finding sets it. For an A+, we also install it in a fresh copy of Zotero and record every server it contacts. How we grade has the details.

The problems we find most often

Among the B and C grades. A plugin can have more than one.

1. 392
   A web page can trigger it through a zotero:// linkWeb pages can open zotero:// links. Most of these come from zotero-plugin-toolkit 5, a library many plugins are built with. It adds two links the plugin may never use: one installs add-ons without asking, the other runs code after asking. Toolkit 6 removed them.For example Better Notes for ZoteroHow developers remove them
2. 202
   Launches programs on your computerSometimes that's the job, such as opening a file in another app. The card links to the code that does it.For example Better BibTeX for Zotero
3. 67
   Its updates could come from someone elseZotero installs updates from the address a plugin names. If someone else could control that address, or the plugin updates itself outside Zotero's updater, a new version could arrive that nobody has checked.For example Ethereal Style
4. 58
   Sends data somewhere we couldn't identifyIt contacts a server that isn't a service we could name, or uses the network in a way we couldn't trace.For example Jasminum
5. 39
   Runs native or compiled codeCompiled code can't be read like the rest of a plugin, so our checks can't see what it does.For example Easier Citation
6. 30
   Installs software packages from npm or PyPIPackages it downloads aren't part of the release we checked. Without a fixed version, what it runs can change on any day.For example llm-for-zotero
7. 28
   Changes Zotero's database itselfYour whole library is in that database, so we flag plugins that add their own tables to it or write to it directly.For example Beaver
8. 18
   Sends data through a public relay or hosting platformThe server isn't run by the developer or a service we could name, so we can't tell who can read what's sent.For example Folder Import for Zotero
9. 18
   Runs a server other programs can reachA local server lets other programs ask the plugin to act. Some don't check where requests come from, so any website you visit could use them.For example Zotero MCP Plugin
10. 17
    Downloads and runs a programWhat it downloads isn't part of the release we checked.For example Zotero AI Sidebar
11. 13
    Sends your text or keys without encryptionOver plain http://, anyone on the network in between can read what's sent.For example Translate for Zotero
12. 12
    Code scrambled or encrypted so nobody can read itCode made unreadable on purpose can't be checked by anyone. We grade it C.For example Ethereal Reference

How to check a plugin before you install it

1. 1Look it up here. Search for the plugin by name, or by what you want it to do.
2. 2Read the grade and the line after "because". That's the most serious finding, and the card links to the file and line it came from.
3. 3Open "Where your data goes". It lists the servers we found in the code. It matters most for plugins that read your papers or notes.
4. 4Check "Works with" and when it was last updated. A plugin that doesn't list Zotero 10 may not load, and one nobody maintains won't get fixes.
5. 5Install the version the card names. The grade belongs to that release. Each new release is checked again, and grade changes go in the public log.