How to protect your privacy when using online tools

Free online tools are one of the great conveniences of the modern web, but they also create a small privacy problem millions of us solve badly every day. The moment you paste a client's copy into a text tool, upload a photo to a compressor, or drop a JSON file into a formatter, you're trusting a stranger with data that might be private, confidential, or legally regulated. Most of the time nothing bad happens. But that's more good luck than good practice.

The first rule is to understand the business model. If the tool has no ads, no subscription, no obvious sponsor, and no mention of who runs it, ask how it survives. Someone is paying the hosting bill. Sometimes it's a developer running the tool as a hobby, sometimes it's a company treating the tool as a marketing funnel, and sometimes — most concerning — the tool exists to harvest whatever gets pasted in. Reading the About page and the privacy policy takes two minutes and usually answers the question.

The second rule is to look for 'runs in your browser' language on the tool's homepage. A properly built client-side tool never uploads your data anywhere — every calculation happens locally in JavaScript. You can verify this yourself by opening the browser's DevTools network tab and watching for outbound requests as you paste text. No requests means no leak.

The third rule is to redact before you paste. If you're using a JSON formatter to inspect an API response, strip API keys and personal information first. If you're using a text tool on a legal document, replace real names with placeholders. It's a small habit that eliminates the worst-case outcome even if the tool turns out to be untrustworthy later.

The fourth rule is to avoid tools that require sign-up for something a five-line function could do. Every account you create is another database that could be breached, another email address that could be sold, and another set of terms of service that could change. If a simple slug generator asks for your email before it'll return a slug, close the tab.

The fifth rule concerns browser extensions. A browser extension has access to everything you do in your browser, including passwords, banking, and email. Installing one to save five seconds is almost never worth it. Prefer a web page you can visit, use, and leave.

Watch out for uploads. Image compressors, PDF splitters, and file converters often require you to upload files to a server because doing the work in the browser is technically harder. That doesn't mean these tools are malicious, but you should be more selective. Ask: is this file okay to share with a stranger? For a photo of your holiday, probably yes. For a signed contract, definitely no.

For truly sensitive work — health data, legal filings, source code with credentials — consider offline tools. Most operating systems ship with built-in utilities for text manipulation, image resizing, and archive extraction. VSCode has extensions for JSON formatting and regex testing. A command-line tool like ImageMagick will compress images without ever touching the network.

Finally, treat privacy policies as part of the tool. A serious operator publishes a clear, jargon-free privacy policy that says exactly what happens to your data. If a tool's policy is missing, hidden behind a broken link, or padded with generic templates, treat that as the strongest signal you'll get about how much they respect you.

Privacy isn't paranoia. It's the practice of asking sensible questions before you hand over data you can't take back. Do it a few times and it becomes second nature, and the web feels a lot less risky.