Mozilla's documentation says extensions and themes must be signed by Mozilla before they can be installed in release and beta Firefox. Signing happens through addons.mozilla.org, for public listings and for self-distributed add-ons alike. Every submission goes through automated validation first. A signature shows the package passed that gate, not that a person reviewed it.
What signing is and is not
Signing here is a gate controlled by the browser vendor. The package is uploaded, validated, and returned with a signature that release Firefox accepts. That is different from a developer signing their own code with their own key.
It also does not equal human approval. The documentation says all add-ons, listed or unlisted, can be manually code reviewed at any time after submission against the Add-on Policies. Outcomes can include rejecting current or previous versions, or blocking the add-on. So a signature today can be followed by a block tomorrow.
What gets signed and where unsigned still runs
| Build | Unsigned extensions |
|---|---|
| Release Firefox | Not installable |
| Beta Firefox | Not installable |
| Developer Edition, Nightly, ESR | Possible if the signature requirement preference is turned off in about:config, and the extension has an add-on ID |
Dictionaries do not need signing. For teams, the practical consequence is that an unsigned extension reaching a managed release browser should not be possible without policy changes, so a request to disable signature checks is a red flag worth escalating.
Ways to submit for signing
According to the signing overview, you can use the Developer Hub web upload, the web-ext sign command, or the add-on API versions. Not every method supports every case. Newer web-ext versions cover initial submissions and updates for listed or unlisted extensions, while older ones and the V4 signing API are limited for some first submissions. If your CI pipeline signs releases, check the version you pin.
Timing
Signing can take up to 24 hours, or longer if the submission is selected for manual review. Plan releases accordingly. For a security fix, submit early and do not tie a deadline to the signature landing.
Why it matters to a security team
A few reasons to care:
- Provenance of the gate. Everything that reaches a release browser passed one common validation step.
- Blocking power. Mozilla can block versions or entire add-ons that break policy, and may block immediately if an add-on appears to intentionally or repeatedly violate policies or the developer is unreachable.
- Self-distribution is still reviewable. Unlisted add-ons are not outside the policies. They are subject to the same distribution agreement and policies.
What signing cannot tell you is whether an extension's permissions are sensible for your use, whether its publisher is who you think, or what it will do after the next update. Those remain your review questions. A short intake check works well: list requested permissions, confirm the publisher, read the policy page, and decide on update handling.
For internal tools
If your company builds a Firefox extension for staff, you still sign it through the same service. Choose self-distribution if it should not appear publicly. Keep the add-on ID stable, since unsigned development installs depend on it, and so do updates.
Safeguard's Firefox add-on is one of the surfaces its developer tools ship on, and its dependency scanning applies to the packages your own extension bundles.
Quick check
Is a signed Firefox extension reviewed by a person?
Not necessarily. Automated validation always runs. Manual review can happen at any time, but a signature alone does not promise it.
Can I run an unsigned extension in release Firefox?
No. Release and beta require signing. Developer Edition, Nightly and ESR can allow it with a preference change.
Do private or unlisted add-ons skip the rules?
No. They are still signed through the same service and subject to the Add-on Policies.
Sources
- Mozilla Extension Workshop: Signing and distribution overview
- Mozilla Extension Workshop: Add-on policies
Last reviewed: 19 October 2026.
