Comparison with the Add-on SDK

This article is a technical comparison of the Add-on SDK and WebExtensions technology. It's intended to help orient people who have an add-on that uses the SDK, and who are planning to port it to use WebExtension APIs.

Support for extensions using XUL/XPCOM or the Add-on SDK was removed in Firefox 57, released November 2017. As there is no supported version of Firefox enabling these technologies, this page will be removed by December 2020.

If you're planning to port an overlay extension or a bootstrapped extension, see Comparison with XUL/XPCOM extensions.

The basic structure and concepts of the Add-on SDK are shared by WebExtensions. Both technologies include:

Beyond these broad similarities, there are a lot of differences in the details, and these are summarised in the following sections.

Manifest files

In both technologies you have a JSON manifest file in the extension's root directory. In the SDK this is called package.json, while in WebExtensions it's called manifest.json. Both files contain basic metadata such as the extension's name, description, and icons.

However, manifest.json includes many keys that define parts of the extension's capabilities and behavior, which in the SDK are more often defined in code. For example:

Feature Add-on SDK WebExtensions
Content scripts matching URL patterns page-mod API content-scripts key
Toolbar buttons ui/button/action API browser_action key
Access privileged APIs require() function permissions key

This makes developing extensions with WebExtension APIs more declarative and less programmatic, compared with SDK add-ons.

With the SDK you'll typically use jpm init to create a new package.json. The WebExtensions technology doesn't have an equivalent of jpm init, so you'll probably write the manifest from scratch or copy and adapt an existing one.

Persistent scripts

Both technologies have the concept of persistent scripts that stay loaded for the extension's lifetime, have access to privileged APIs, and can communicate with other parts of the extension such as content scripts.

In the SDK this script is by default called index.js, and it can load other scripts using the module loader.

With WebExtensions, these scripts are called "background scripts". You can define a set of scripts using the background manifest key, and they will all be loaded into the same document, which is a hidden, auto-generated, blank HTML page. You can also define your own custom document using the background key.

An important difference is that background scripts get a window global, with all the DOM objects you'd expect to be present on a window. This makes writing extensions more like writing web pages, with direct access to all the normal Web APIs like XMLHttpRequest or IndexedDB.

Also note that by default, extensions have a Content Security Policy applied to them. You can specify your own policy, but the default policy, among other things, disallows potentially unsafe practices such as the use of eval().

Learn more

Content scripts

In both the Add-on SDK and WebExtensions, persistent scripts can't directly access the content of web pages. Instead, extensions can attach content scripts to web pages. These scripts:

  • do get direct access to web content
  • don't have access to privileged APIs
  • can communicate with the persistent scripts using a messaging API.

In both technologies, there are two ways to attach scripts: you can automatically attach a set of scripts to pages whose URL matches a given pattern, or you can programmatically attach a script to the page hosted by a given tab. The way to do this is different in each technology, though:

Operation Add-on SDK WebExtensions
Attach scripts to pages matching URL pattern page-mod API content-scripts key
Content scripts matching URL patterns tab.attach() tabs.executeScript()

The match patterns used for URLs are different:

In both technologies you can pass options to control when the script runs and whether it will be attached to subframes. WebExtensions don't include an equivalent of contentScriptOptions, though, so to pass configuration options to a content script in an extension, you would either have to send them in a message or store them in storage.local.

In both technologies, content scripts can communicate with persistent scripts using an asynchronous messaging API:

Operation Add-on SDK WebExtensions
Send message port.emit() runtime.sendMessage() / tabs.sendMessage()
Receive message port.on() runtime.onMessage

In both cases, content scripts can communicate with scripts loaded by the page using window.postMessage and window.addEventListener.

In both technologies, have access to the page they're injected into, but get "a clean view of the DOM", meaning that they don't get to see modifications made to the DOM by scripts loaded by the page.

In the SDK, content scripts can share objects with page scripts, using techniques like unsafeWindow and createObjectIn. With WebExtensions, the unsafeWindow is available via wrappedJSObject instead. All the export helper functions are available, too.

Learn more

UI elements

Both technologies provide APIs to create a UI for your extension. UI options for WebExtensions are more limited.

UI Element Add-on SDK WebExtensions
Button ui/button/action browser_action / page_action
Toggle button ui/button/toggle browser_action / page_action
Toolbar ui/toolbar None
Sidebar ui/sidebar sidebar_action
Panel panel browser_action / page_action popup
Context menu context-menu contextMenus

Panels and popups

Panels and popups are both transient dialogs specified using HTML, CSS, and JavaScript.

Unlike panels, popups are always attached to a button (either a browser action or a page action) and can't be displayed programmatically: they are only shown when the user clicks the button.

Also unlike panels, popup scripts get access to all the same APIs that background scripts do. They can even get direct access to the background page, via runtime.getBackgroundPage().


The Add-on SDK and WebExtensions both have some support for settings (sometimes also called options or preferences).

With the SDK you can define preferences using a preferences key in package.json. The user can see and change these preferences in the extension's entry in the Add-ons Manager. The extension in turn can listen for changes using the simple-prefs API.

With WebExtensions, you will have to implement your own UI for presenting settings, and your own code for persisting them for your extension. You do this by writing an HTML file that presents the settings UI, which can include a script for persisting the settings. The script gets access to all the WebExtensions APIs, and it's generally expected that you should use the storage API to persist settings.

You then assign the HTML file's URL to the options_ui key in manifest.json. Your settings page then appears in the extension's entry in the Add-ons Manager. The options page can also be programmatically opened with an API call to browser.runtime.openOptionsPage.

Note that WebExtensions does not provide an equivalent of the SDK's preferences/service API, which provides general access to browser settings. However, you can change some browser settings using the privacy and browserSettings APIs.

Learn more


The Add-on SDK and WebExtensions both include tools for localizing user-visible text. They offer mostly similar functionality:

Feature Add-on SDK WebExtensions
Strings in add-on scripts Yes Yes
Strings in content scripts No Yes
Strings in HTML Yes No
Strings in CSS No Yes
Title & description Yes Yes
Plural forms Yes No
Placeholders Yes Yes

In both systems, you supply localized strings as a collection of files, one for each locale.

To retrieve localized strings in extension code, there's a JavaScript API - l10n in the SDK and i18n in WebExtensions - that returns a localized string given an ID.

WebExtensions don't have direct support for localizing strings appearing in HTML, so you have to do this yourself, using JavaScript to retrieve localized strings and to replace the HTML with the localized version.

Learn more

Command-line tool

The Add-on SDK comes with a command-line tool, jpm, that you can use for testing and packaging extensions. There's an equivalent tool for WebExtensions, called web-ext. web-ext doesn't yet support all the same commands that jpm does, but it has the basics: run, build, and sign.

It's also now possible to install (and reload) SDK add-ons and extensions built with WebExtension APIs in Firefox from their source directory, without needing to package them as an XPI. See Temporary Installation in Firefox.

Learn more

JavaScript APIs

In both the SDK and WebExtensions, the main power of the extension comes from a set of dedicated JavaScript APIs. For most of the SDK high-level APIs, there is a WebExtensions equivalent.

One big limitation of WebExtensions compared with the SDK is that SDK add-ons can use require("chrome") to get access to the full range of XPCOM APIs in Firefox. This is not possible with WebExtensions.

To access privileged APIs in the SDK, you use require():

var tabs = require("sdk/tabs");"");

With WebExtensions most APIs are made available already, with no need to import them:

browser.tabs.create({ "url": "" });

For some WebExtension APIs, you need to ask permission first, using the permissions manifest.json key. In the example below, the extension will need to ask for the "tabs" permission if they want access to the tab's URL:



"permissions": [


background script:

function logUrl(tabs) {

var querying = browser.tabs.query({
active: true,
currentWindow: true


Add-on SDK => WebExtensions

The tables in this section list every SDK API and describe what the equivalent WebExtensions API would be, if there is one implemented in the current Developer Edition.

The first table covers high-level SDK APIs, the second covers low-level APIs.

High-level APIs

Add-on SDK WebExtensions
addon-page Use tabs.create() to load pages packaged with your add-on into normal browser tabs.
base64 window.atob() and btoa()
clipboard document.execCommand without using select() and similar in the background page.
context-menu contextMenus
hotkeys commands
indexed-db window.indexedDB
l10n i18n
notifications notifications
page-mod content_scripts
page-worker Porting isn't complete and being treated in Bug 1318532

Workarounds (that might require webrequestBlocking to access all webpages [example]):

- Use the background page
- load remote iframes into the background page
- make an AJAX call to get static information from the page
/panel See UI elements above.
/ passwords Experimental logins API
private-browsing Tab.incognito and Window.incognito.
querystring window.URLSearchParams
request window.fetch or window.XMLHttpRequest
selection Use a content script that sends the selection data to the add-on. Alternatively, if you can use a contextmenu on a selection, the selection is contained in selectionText (see contextMenus.OnClickData).
self runtime.getManifest() and extension.getURL() for data.url()
simple-prefs storage and options_ui
simple-storage storage
system Partly provided by runtime.
tabs tabs
timers alarms
ui See UI elements above.
url window.URL
widget None
windows windows

Low-level APIs