6 min read · updated 2026-07-29
How to tell if a free web tool is safe to use
Find out whether the file leaves your machine
This is the single most useful fact about any tool that takes a file. Open the network tab in your browser's developer tools, drop the file in, and watch. If nothing large goes out, the processing is happening on your device and the file never travelled.
A faster proxy: load the page, disconnect from the network, then try the tool. Anything that still works is doing the job locally. Tools built this way usually say so, because it is their main selling point — but the disconnect test is the version you do not have to take anyone's word for.
Read the sentence about deletion, not the one about encryption
Almost every upload-based tool advertises encryption in transit. That is table stakes and tells you nothing about what happens after the file arrives. The sentence worth finding is the one about retention: how long the file is kept, and whether deletion is automatic or something you have to request.
"Files are deleted after one hour" is a real commitment. "We take your privacy seriously" is not a commitment at all.
Check where the wall is before you start, not after
The expensive version of a free tool is the one that lets you do forty minutes of work and then asks for a card to export. Before investing any effort, find the download or export step and confirm what it produces — a watermark, a resolution cap, and a format restriction are the three most common walls.
A tool that shows its limits up front is usually more honest about everything else too.
Be suspicious of tools that want more permission than the job needs
A background remover does not need access to your contacts. A PDF merger does not need to connect to your cloud drive to merge two files you already have. Permission requests that exceed the task are the clearest signal that the product is collecting rather than serving.
The same applies to sign-in walls: if a tool insists on an account before doing something that is technically possible without one, the account is the product.
Look at whether anyone is still maintaining it
A blog with a post from four years ago, a broken support link and a copyright date in the past are all cheap to check and reliably correlated. An unmaintained tool is not necessarily unsafe, but it will not be patched, and it is the category most likely to vanish or change hands quietly.
Domain age cuts both ways: a very new domain offering a service that normally costs money deserves more scepticism than an old one.
Never paste secrets into a tool to "test" it
The most common real-world leak from web tools is not a breach, it is someone pasting a live API key into a JSON formatter or a production database dump into an online SQL beautifier to see whether the tool works. Test with fake data that has the same shape.
If a tool needs a credential to do its job at all, that is a decision to make deliberately, with a scoped key you can revoke — not something to discover halfway through.
In short
- Disconnect from the network and retry — anything that still works never uploaded your file.
- Retention policy beats encryption claims. Look for a stated deletion window.
- Find the export step before you start working, not after.
- Permissions beyond the task, and accounts required for tasks that do not need one, are both signals.
- Test with fake data shaped like the real thing.