Are Free Online Tools Safe? A Checklist Before You Paste
Free online tools are convenient until the moment you paste something you should not. A browser-based converter, password generator or date calculator can solve a small problem in seconds, but many of them send your input to a server to do the work. That is fine for a public weather forecast and a mistake for a contract clause, a medical record number or the only copy of a private key.
This guide shows how to check, in about a minute, whether a tool processes your data inside your browser or ships it elsewhere. It also explains the legal gaps that terms-of-service pages usually leave open, and when you should close the tab and use a spreadsheet, a native app or a paid professional instead. Nothing here is legal, financial or medical advice; it is a practical filter for a common risk.
What 'runs in your browser' really means#
When a tool says it runs locally, the calculation, conversion or generation happens on your own computer using JavaScript loaded from the site. The page may still fetch the code itself, fonts or analytics scripts from the internet, but your input should not appear in a network request. True local tools can often work offline after the page loads, and they do not need your email address, a login or a credit card for a one-off task.
A privacy policy that says the site processes data on its servers is at least honest; a missing page is a stronger negative signal.
How to check the Network tab in under a minute#
Every mainstream desktop browser has a built-in Network panel that logs every request a page makes while you interact with it. The test takes about sixty seconds and needs no extensions or technical background. You simply paste dummy data that is distinctive enough to spot in a request, trigger the action, and watch for outbound traffic while the result appears. If the only new lines are analytics, fonts or style sheets, the tool is likely local. If your dummy string shows up in a request body or URL, the site is sending your input somewhere else.
- Open the tool in a new tab and press F12 (or Ctrl+Shift+I / Cmd+Option+I) to open Developer Tools.
- Click the Network tab, then clear any existing log by clicking the clear icon or pressing Ctrl+Shift+E.
- Type or paste a distinctive but fake string, such as TEST1234-siteb-priv-check, into the tool.
- Trigger the action: convert, generate, count or calculate.
- Watch the Network log. If your string appears in a request URL or body, the tool uploaded it.
- Repeat once with a file drag-and-drop if the tool accepts documents, since some tools upload files while claiming the preview is local.
A few tools send only a hashed or encrypted version of your input; that is better than plain text, but you still have to trust the operator.
Red flags that should make you close the tab#
Some warning signs are easier to spot than a network request. They do not prove the operator is malicious, but they do prove the site was not built with your privacy as the default. A red flag should shift the burden of proof: the site now has to show you why it is safe, rather than you having to prove it is dangerous. These six patterns come up again and again on free online tools that later turn out to be careless with data.
- A mandatory account or email for a trivial calculation, such as a word count or unit conversion.
- No privacy page, terms page or contact details, or a privacy policy dated years ago and copied from a template.
- A noticeable delay between input and result for a task your phone could do instantly, suggesting a remote server.
- Requests for permissions that have nothing to do with the job: camera, microphone, contacts or location.
- An upload button that opens immediately rather than processing locally after the file is selected.
- Aggressive monetisation: multiple pop-ups, auto-downloads, or prompts to install browser extensions.
One red flag alone is not proof of harm, but it should move the burden of proof onto the site.
What the terms of service usually allow#
Most free tool sites rely on standard legal clauses that favour the operator. You rarely ‘sell’ them your data in a literal sense, but you usually grant a broad licence to use, display, adapt and distribute whatever you submit. That licence is often described as irrevocable, worldwide and royalty-free, and it can survive even after you close the tab. The terms also tend to disclaim accuracy and liability, which means a wrong conversion or leaked file is your problem, not theirs.
| Clause you will see | What it can mean in practice |
|---|---|
| Broad licence to user content | The site can keep, modify and share what you pasted, including in product demonstrations or datasets. |
| No warranty / as-is | If the calculation is wrong and you lose money, the operator is not liable. |
| Right to share with service providers | Your data may be passed to hosting, analytics or advertising partners. |
| Public data may be indexed | If the tool produces a shareable link, search engines or archive sites may store it. |
| Arbitration and jurisdiction | You may have to sue in another country and waive class-action rights. |
Terms pages are written to protect the operator; read them as a description of risks, not a guarantee of safety.
Data you should never paste into a third-party tool#
The safest rule is simple: if losing control of the data would cause harm, embarrassment, financial loss or legal exposure, do not paste it into a browser tab you do not trust. Browser tools are fine for public or low-value information, but they are the wrong place for secrets, regulated data or anything protected by a confidentiality agreement. The following categories are almost always better handled on your own device or by a professional bound by duty.
| Category | Why the risk is high | Use instead |
|---|---|---|
| Passwords and private keys | A server can store or leak them; keyloggers and malicious scripts are also a risk. | A password manager or offline generator. |
| Legal contracts and NDAs | Confidentiality obligations may be breached; the site may gain a licence to the text. | A local word processor or solicitor-reviewed workflow. |
| Medical record numbers and test results | GDPR and HIPAA-style rules may apply; accidental disclosure is irreversible. | Your health portal or a clinician. |
| Bank account numbers, card details and tax identifiers | Fraud and identity theft; many terms disclaim liability for errors. | Your bank's app, accountant software or a spreadsheet on an encrypted drive. |
| Unpublished source code and trade secrets | Broad content licences and indexing can expose intellectual property. | A local IDE or company-managed code host. |
| Scanned identity documents | Facial images and document numbers are high-value targets for fraud. | Offline scanning or the requesting institution's official portal. |
This list is illustrative, not exhaustive. When in doubt, keep the data on a device you control.
When free online tools are the wrong choice#
Free browser tools suit quick, low-stakes tasks where a small error does not matter much: converting a recipe from cups to grams, counting characters in a social post, or generating a one-time QR code for a public Wi-Fi password. Once the output affects money, health, legal rights, employment or reputation, the convenience stops being worth the risk. At that point you need an audited app, a regulated professional, or at minimum a spreadsheet you control on an encrypted device.
| Situation | Why a browser tool may fail | Better option |
|---|---|---|
| Currency or tax calculations for a business | Exchange rates may be stale; terms disclaim accuracy. | Accounting software or a qualified accountant (€50–€250 per hour depending on complexity). |
| Medical dosage or date calculations for treatment | A wrong result can affect care; no tool knows your full history. | A clinician or pharmacy professional. |
| Drafting legal notices or contracts | Template errors and confidentiality breaches are expensive. | A solicitor (€150–€400 per hour in most EU markets). |
| Generating passwords for high-value accounts | You cannot verify the generator's entropy or honesty. | A reputable password manager with audited code. |
| Batch processing sensitive files | Uploading dozens of documents multiplies exposure. | A local script, desktop app or private server. |
Prices are rough EU ranges and vary by country and specialism; always agree a fee before engaging a professional.
A practical workflow for everyday tasks#
You do not need to audit every site. A short routine keeps most risks low. Start by asking whether the data is public, then run the network-tab test on any new tool, keep a short list of trusted tools for repeated jobs, and default to native apps when the stakes rise. Siteb.biz is an independent directory of free online tools and runs its own small utilities entirely in the browser; use this checklist on any third-party subdomain the same way you would on any unfamiliar site.
- Treat every new tool as untrusted until the Network tab confirms it is local for your task.
- Use a fake but identifiable string during the test, never real data.
- Bookmark two or three tools that pass the test for each category you use often.
- Avoid tools that ask for accounts, permissions or file uploads for jobs that do not need them.
- Keep sensitive work on your device: spreadsheets, password managers, desktop apps or professional services.
If a tool needs a server for a legitimate reason, such as generating a QR code image on demand, read its privacy policy and decide whether the trade-off is acceptable.
Frequently asked questions
If a tool says it is secure, should I trust it?
‘Secure’ is a marketing word, not a technical guarantee. A site can use HTTPS — which only protects data in transit — and still store everything you submit on its servers. Look for specific claims: the code runs in your browser, no data leaves your device, no account is required. Then verify those claims with the Network tab test described above. A privacy policy helps, but it is not a promise of local processing. If the tool handles something sensitive and the operator does not clearly explain where the computation happens, treat it as server-side and choose a local app or a professional instead.
Can I safely use a QR code generator or password generator online?
It depends on what the generator creates and how it works. A QR code for a public café menu is low risk; a QR code embedding a private Wi-Fi password or payment request is not. Password generators are only safe if the code runs locally and you can inspect or trust the entropy source. Even then, generating a password inside your browser exposes it to any malicious script loaded by the page or a compromised extension. For high-value accounts, use an audited password manager instead of a browser tab. For one-time, low-stakes codes, a local browser generator you have tested is usually acceptable.
What is the difference between a local browser tool and a server-side tool?
A local browser tool downloads JavaScript to your computer and performs the calculation or conversion there. Your input never has to leave the device for the core task, though the page may still load code, fonts or analytics from the internet. A server-side tool sends your input to a remote computer, which processes it and returns a result. Server-side is necessary for heavy tasks, large files or features that need a database, but it creates a permanent record on someone else's hardware. The Network tab test is the fastest way to find out which model a site is using for your specific action.
is this online tool safefree online tool privacy checkhow to check if a website uploads your databrowser network tab privacy checksafe online password generatorfree online tools privacy risks
