There is information people type into convenient web tools without thinking. What to be careful about.
📚 Free Web Tools · 1/12·⏱ 阅读约需 4分钟·信息更新 2026-10-01
📋 基本信息4
Key
Whether it runs in your browser or sends to a server
Most dangerous
Entering passwords or personal data you actually use
How to check
If it works with the internet disconnected, it runs locally
Note
Ask how a free tool pays for itself
Local processing and server processing are entirely different
Web tools come in two kinds: those that compute inside your browser, and those that send what you enter to a server and return a result. With the first, your input never leaves your device; with the second, it reaches that server. For identical functionality, this difference decides almost all of the safety question. The trouble is that you cannot tell which from appearance. A clean design does not mean local processing, and heavy advertising does not mean your input is being sent away.
How to tell which one you are using
The most reliable check is to load the page, disconnect from the internet, and try the feature. If it still works, it runs in your browser. You can also watch the network tab in developer tools to see whether a request fires as you type. Treat speed as a hint only; for certainty, use the first two methods.
Load the page, go offline, then use it
Watch the network tab for outgoing requests
Look for a stated claim that processing is local
Instant results suggest no server round trip
What never to enter
As a rule, never type a password you actually use into any online tool — including strength checkers. The same goes for internal company documents, national ID numbers, bank account numbers and medical records. If you must test something, use fake values with the same shape as the real ones. If you have already entered one, changing that password on every service where you use it is the surest response.
How free tools pay for themselves
Free tools still cost money to run. Advertising or paid tiers are the usual answers. When there is no visible business model and the tool asks for sensitive input, it is worth considering that the input itself may be the product. Equally, the presence of ads does not mean your input is handled safely, so the processing method still needs checking on its own.
When you upload a file
Tools that convert images or documents often upload the file to a server. Photos can carry the location and time they were taken as metadata, and documents can carry author information. Deciding whether to strip that first, or to use a tool that processes in the browser, is the safer path. Some services say uploads are deleted after a set time, but users have no way to confirm that they actually were.
Extensions and the clipboard
Even when the tool is safe, data can leak around it. Some browser extensions have permission to read the content of every page you visit, which includes values typed into tools that run locally. Text copied to the clipboard can also be read by other applications, and if clipboard history is switched on, copied values stay in that list.
Review the permissions of installed extensions now and then
Remove extensions you no longer use
Check whether clipboard history is turned on
Avoid sensitive tasks on shared computers
Check the address first
Ads at the top of search results, or fake sites with similar names, can pass for the real tool. Confirm that the domain in the address bar matches the one you normally use, and that the padlock shows an encrypted connection. An encrypted connection only means others cannot read the traffic in transit; it is no guarantee that the site itself is trustworthy. Opening tools you use often from a bookmark is the easiest way to avoid impostors.
Clean up afterwards
On a shared or public computer, tidy up after use. Some tools remember input in browser storage, and downloaded results stay in the downloads folder. A private window clears history and site storage when closed, but it does not remove files you downloaded.