Tampermonkey Review 2026

What is Tampermonkey?

Tampermonkey has more than 12 million users on the Chrome Web Store alone, yet the most common reason scripts stop working on Chrome now is a single permission switch that older guides never mention. People searching "Tampermonkey userscript manager how to use" usually want three answers: how to get scripts running again on Chrome, where to find code that will not steal anything, and whether the paid Safari app is worth buying. This review covers all three, using the official FAQ, changelog and store listings as sources.

In plain terms, the extension runs small JavaScript files called userscripts on the sites you choose. A script can add a download button to a video page, hide recommended clutter, auto-fill an internal form, or pull extra data into a dashboard your team uses daily. Jan Biniok, a German developer based in Saxony, builds it, and it works on Chrome, Edge, Firefox, Opera and Safari. Developers, growth marketers who scrape their own reports, and support teams who live inside one web app all get real use from it.

Tampermonkey Chrome Manifest V3 and the Allow User Scripts switch

If your scripts suddenly stopped firing on Chrome, this is almost always the reason. Chrome extensions now run on Google's Manifest V3 platform, which changes how userscript managers are allowed to inject code. The official FAQ (entry Q209) says that from Tampermonkey 5.3 onward, Chromium browsers need one extra permission before any script can run.

There are two ways to grant it:

• Chrome 138 or newer: right-click the toolbar icon, choose Manage Extension, and turn on Allow User Scripts.
• Older Chrome, or Edge: open chrome://extensions or edge://extensions and switch on developer mode in the top right corner.

Version 5.5.0 made Tampermonkey notice the switch faster once it is on, and the 5.5.1 changelog entry (1 October 2026) notes that script injection now needs a special extension permission. So yes, it works with Manifest V3, but expect to visit that settings page once on every new Chrome profile. That FAQ entry covers Chrome and Edge; Firefox is not part of it.

How to install userscripts in Tampermonkey from a .user.js link

Installation is the easy part. Any URL ending in .user.js is caught by the extension, which opens an install screen showing the script's name, version, the sites it will run on and the full source code. Click Install and it is live on the next page load.

A good first routine looks like this:

• Add the extension from your browser's official store and grant the Chrome permission described above.
• Open a script page on Greasy Fork and press the green install button.
• Read the header lines on the install screen, especially every @match directive and any @connect domains.
• Reload the target site and open the toolbar popup to confirm the script is listed as running.

You can also paste code into a new script by hand. Each script keeps its own update URL, so the manager can auto update scripts on a schedule you set in settings.

Picking Tampermonkey safe scripts on Greasy Fork

Is it safe? The extension itself has a clean record on the Chrome Web Store, which marks it as Featured and describes the publisher as having no history of violations. The risk sits in what you install. A userscript runs with the same view of a page that you have, so a bad one can read what you type into a bank form or a CMS login.

Greasy Fork is the main public library, and its code rules help. Scripts posted there must not be obfuscated or minified, the main logic has to live in the posted code rather than be fetched from another server, and ads, tracking or miners must be declared through @antifeature tags. Moderators delete scripts that break the rules, and any visitor can file a report. OpenUserJS is the other long-running source, though it has its own rules, so read a script there just as carefully.

Practical habits that cut risk:

• Prefer scripts with recent updates, many daily installs and an author who answers feedback.
• Be wary of a script that asks to run on every site (@match *://*/*) when it only needs one.
• Check @require lines. Code pulled from a CDN or GitHub can change after you install.
• Never install a script sent by a stranger on Telegram or WhatsApp that promises free premium features. That is the classic route for account theft.

Tampermonkey also has a blacklist, refreshed from a remote source, and a setting for sites where no script may ever run. Put your banking and payment URLs there.

Tampermonkey userscript manager: how to use it day to day

Most of the time you only see the toolbar popup. It lists scripts active on the current tab, lets you switch any of them off, and runs a manual update check. The dashboard gives a sortable table of everything installed with last-update dates and homepage links.

Settings come in three config modes: Novice, Beginner and Advanced. Novice hides almost everything, which is fine for someone who installs two scripts and forgets them. Advanced exposes per-script sandbox options, injection timing and external editor support. Script sync needs Beginner or Advanced mode. According to FAQ entry Q105, it can use Google Drive, Dropbox, WebDAV or the browser's built-in sync (with a very small storage limit), and it only syncs scripts that were installed from a web address or carry a valid @downloadURL.

A newer addition: version 5.5.0 added Model Context Protocol (MCP) support so AI tools can work with the extension, plus provisioning that lets IT teams install scripts through OS policies. MCP is off by default; it needs the separate Tampermonkey Editors extension and a deliberate step to switch it on.

Writing a first script: the header block, @match and GM_xmlhttpRequest

Click Create a new script and the built-in script editor opens. It is based on CodeMirror and checks syntax with ESLint as you type. Every script starts with a metadata block between ==UserScript== comment lines. The lines that matter most are @name, @version, @match (which pages it runs on), @grant (which special functions it may call) and @run-at (when it injects).

The special GM_ functions are why a manager beats a plain bookmarklet. GM_setValue and GM_getValue store data across visits. GM_addStyle injects CSS. GM_xmlhttpRequest makes requests to other domains that a normal page script would be blocked from, as long as each domain is listed with @connect. A small example: a script for your Shopify admin that calls your courier's tracking page and shows delivery status beside each order.

For longer projects, the official site explains how to @require a local copy of a script so you can write in your usual editor and let the browser pick up changes. That route needs file URL access switched on for the extension. There is also a Tampermonkey Editors extension for working on scripts in vscode.dev.

Free on Chrome, ₹299 on Safari: what Tampermonkey costs

Is it free? On Chromium browsers and Firefox, yes. The Chrome, Edge and Firefox store listings carry no price, and there is no paid tier inside the extension. Safari is different, because Apple distributes it through the App Store as a paid app.

The newer Safari app covers iPhone, iPad, Mac and Apple Vision with Family Sharing for up to six people, so one ₹299 purchase can serve a household. Classic also supports Family Sharing.

Tampermonkey vs Violentmonkey: closed licence against open code

Violentmonkey is the closest rival. Its site describes it as open source, it runs on Chrome (now on Manifest V3), Firefox and Edge, and syncs to Dropbox, OneDrive, Google Drive or WebDAV. It shows no ads and keeps its interface lean.

Tampermonkey's code was public under GPLv3 only up to version 2.9; its GitHub repository says all later versions use a proprietary licence. Firefox lists it as All Rights Reserved. What you get for that trade-off is a larger API surface (cookies, tabs, downloads, audio and web request helpers), a Safari build, OS policy provisioning and a very large user base, so most popular scripts are likely to have been tried on it.

Against Greasemonkey, the comparison is short. Greasemonkey is a Firefox add-on with about 159,000 users on Firefox Add-ons, MIT licensed and maintained by Anthony Lieuallen, but with a smaller set of extra functions. Tampermonkey includes a compatibility layer for scripts written for Greasemonkey 3.x and earlier.

Pick Violentmonkey if you want auditable code and only use Chromium or Firefox. Pick Tampermonkey if you need Safari, the widest script compatibility or managed deployment across company laptops.

What the extension sends home, and the switches that stop it

The privacy policy, with Jan Biniok in St. Egidien, Germany as data controller, says the extension reports anonymous usage data: its version, your language, script install events (used for blacklist updates) and browser and OS type. Error reports go to a self-hosted Matomo instance. You can turn off Anonymous statistics in settings, and nothing is sent from incognito windows where the browser supports it. Changing the Script Blacklist Source and update notification settings stops the remaining calls, though blacklist updates stop with them.

For company use, there is no separate business plan on the official site, and the OS policy provisioning added in 5.5.0 is aimed at managed fleets. Read the licence terms before a large rollout. Scripts you write yourself stay yours.

Where the extension still frustrates people

• The Chrome permission step confuses non-technical colleagues, and it resets on fresh profiles.
• Closed source code means you trust one developer rather than auditing the manager itself.
• Support is a FAQ, documentation and a bug report form. The site lists no live chat or status page.
• Browser sync storage is tiny, so teams with many scripts should use Google Drive or WebDAV.
• Scripts break when a site changes its layout, and fixing them depends on the script author.

Start with one well-reviewed script on a site you use daily, confirm the Chrome toggle is on, and add your payment domains to the blacklist before installing anything else.