What is the "JavaScript Toggle On and Off" extension, and how does it work?

The "JavaScript Toggle On and Off" extension aims to provide an easy method to toggle JavaScript on and off with the minimum possible interference with browser activities. There are many similar extensions, but usually either they are very complex or they cannot block JavaScript reliably. This extension asks your browser to disallow JS execution when possible. If not, it changes the "Content-Security-Policy" header of the "main_frame" and "sub_frame" requests to prevent JavaScript execution of both inline and external sources in web pages. This extension can reliably block all sorts of JS executions.

recommended "Password Lock for WhatsApp Web" extension for Chrome, Edge, and Firefox browsers

This extension adds a password protection feature to your WhatsApp Web. It requires the user to enter a password to access the interface, and can also automatically lock the interface when the computer is inactive for extra security. Read more here.

[version >= 0.3.0] How do I know if JavaScript is enabled or disabled?

When JavaScript is globally disabled, the extension adds a gray "×" badge on the action button. For the domains on the exception list (which can still execute JS although it is globally disallowed), there is a green circle on the top-left side of the action button. When Javascript execution is globally permitted, there is no badge text. However, if JS execution is disallowed for a domain (a domain on the exception list), there will be a red line beneath the action button. Note that, on Chromium browsers, there is a disallow symbol on the address bar when JS execution is not permitted for the currently loaded website.

Do I need to turn off JavaScript execution in my browser?

If this is the first time you visit a website, it is recommended to temporarily block JS execution. By blocking the JS engine, the risk of being tracked or attacked is significantly reduced. Also, some pages use JavaScript to hide part of their content for unknown users (paywalls). By turning JS off, you can read the content since the blocking script has no chance to interfere.

There is a good article on how JavaScript execution might compromise your privacy which I recommend to read; webextension.org/blog/.../html5-apis-fingerprint-users-how-to-prevent.html.

Is the "JavaScript Toggle On and Off" extension effective on the private (incognito) tabs?

Yes, this extension can operate on incognito mode if it is allowed by the extensions manager. You need to enable the extension's access to the private context. If so, the network observer is installed on top of the browser and can block both normal and private mode requests. Note that you will need to refresh a tab if it has already been loaded before the blocking mode is enabled in order to attach the policy rules to stop the execution of JavaScript codes.

When the extension is in disabled mode (no JavaScript blockage), is it still using browser's resources?

Pretty much no. The extension uninstalls all its observers when the blockage mode is off and hence it has the minimum possible impact on your browsing experience.

Is it possible to change the location of the toolbar button as I am not frequently using the extension?

Yes, read a Comprehensive Guide to Firefox Customization to find out how to change the toolbar button's position. If you are not using the extension too much, you can also try my the other extension to completely disabling this one when it is not neccessary, Add-on Manager with Profiler. Basically you can create multiple profiles and enable and disable certain extensions within a profile.

How can I make sure if JavaScript execution is completely blocked when the extension is enabled?

There is an online service you can use to make sure JavaScript is enabled or not; https://webbrowsertools.com/javascript. Make sure to try this service on both private and normal tabs.

The extension icon is not appearing in the incognito mode in Chrome and Opera browsers. Is this an expected behavior?

Well, in Chrome based browsers, extensions are not allowed in the incognito mode by default. Open "chrome://extensions/" and check "Allow in incognito" and you will notice the icon appearance in the private windows. Also blockage will automatically applies to the private mode as soon as the icon is present.

This extension blocks JavaScript execution. However, there are certain domains that need JS to operate normally and I can trust them. Is it possible to enable JS execution even though it is globally blocked?

You can add domains to the exception lists for both enabled and disabled modes. It means for both enabled and disabled modes, there are separate lists of domains that act opposite (if JS is enabled, JS execution is disabled on them, and if JS is disabled, JS execution is permitted on them). To add a hostname to the exception list, use the right-click context menu over the action button. If the hostname is not in the list, the extension adds it to the list. If it is already in the list, the hostname will get removed and you will be notified. For bulk action, use the options page.

For Firefox version, white-listing is not available unless you are on the WebExtension version of this add-on.

In Firefox browser, there is a flag called javascript.enabled. Does this extension alter this flag to disable the browser's JavaScript engine?

There are two versions of this extension. In the WebExtension compatible version, there is no interaction with the internal preferences (there is actually no way to interact with them!). To block JavaScript engine, the extension manipulates policy rules of the top request so that no JS code can be executed (it will violate the policy rule). Note that turning javascript.enabled off from the "about:config" may result in a different visual appearance compared to when this extension blocks the JS execution. In the former method, website is aware that there is no JS access and hence it might redirect user to the HTML only version of the page, however in the latter method, there is no signal for the server to know that JS is not supported and hence normal page is loaded but JS code is not being executed.