5-test interactive checklist

Audit any free tool — before you type a real number into it

Open the tool you're evaluating in another tab. Then open DevTools (Cmd+Opt+I / Ctrl+Shift+I). Run these five tests. Each one is under a minute. Your checkbox state saves to your browser's localStorage so you can come back to a half-finished audit.

Do this: In the tool tab, open DevTools → Network. Clear the list. Type one digit into any field.

Pass: Network tab stays empty.

Fail: Every keystroke POSTs to a server. Walk away.

Do this: Look at the area immediately around the form fields. Is there a sentence telling you what happens to your inputs?

Pass: A data-handling statement is visible without scrolling.

Fail: "Privacy Policy" link buried in the footer is not the same thing.

Do this: Try to use the tool without entering any personal info. Try to see results.

Pass: No gate. The tool just works.

Fail: "Enter your email to see your results." Your numbers are the price.

Do this: DevTools → Network → filter JS. Reload. Look at the domain of every script.

Pass: Every script is the tool's own domain plus at most one privacy-first analytics provider (Plausible, Fathom).

Fail: google-analytics.com, googletagmanager.com, facebook.net, hubspot.com, hotjar.com, fullstory.com, segment.io — your inputs are being recorded.

Do this: Right-click on the tool page → View Page Source. Or open the tool's main JS file from DevTools → Sources.

Pass: Unminified, function names are descriptive, every comment is in the source.

Fail: 4-megabyte minified bundle, single-letter variable names, math hidden inside a framework dashboard.

Score: 0 / 5

Run the tests above. Each checkbox = one pass.

Want the underlying frame? Read the long-form article · See Muntin's data promise · Information security topic