Online Privacy Guide: Threat Models for Browser-Based Work

Almost everyone now handles data with some privacy weight, through a stack of tools whose trust model they have never looked at. This is the map of that problem: which threats are worth defending against, the one check that settles most questions, and where the tools on this site sit, stated honestly rather than favourably.

Name the threat before choosing the tool

"Privacy" is not one thing, and the right answer changes with who you are hiding from.

Casual proximity. Someone who has no interest in you but can see your screen, borrow your laptop, or inherit your old phone. Lock screens, separate accounts, a hand over the webcam. No special tools.

Commercial aggregation. Firms building a profile by joining ad tracking, breach dumps and purchased data. Tracker blocking, fewer accounts, separate email addresses, and the assumption that a free service is monetising something.

A specific person after you. An ex-partner, a competitor, a state. This needs metadata discipline, compartmentalisation and often professional help, and nothing on this page is sufficient for it. Naming it matters mostly so you can tell when you are in it.

Almost all everyday practice targets the first two.

The question that settles most of it

Does the data reach a server, or stay on the device? That is structural, not a policy position, and it is observable.

Open DevTools, go to the Network tab, filter to Fetch/XHR, run the tool on something harmless, and watch. An upload is a request about the size of your data. A local tool shows nothing carrying your input, though it may fetch a WebAssembly module or a font.

Thirty seconds. It replaces reading a privacy policy with watching behaviour, and it works on any site including this one.

Why Your PDF Tool Should Run in the Browser and Client-Side Image Compression go through what leaks for those two file types specifically.

Our own tools, counted rather than claimed

Earlier versions of this guide said all the tools it linked run in the browser. That was not true, and the tools it named were the exceptions.

Twenty-one of two hundred and sixty-two tools upload. They are the ones that need a real media pipeline: all video and audio work, PDF compression, PDF password protect and unlock, the variants explicitly named Server-Side, AVIF conversion, the server-side resizer, and the dedicated EXIF stripper. Those files go to servers in the EU and are deleted after fifteen minutes.

The EXIF stripper is worth pausing on, because the irony is sharp: it removes location data from a photo by uploading the photo first. If that photo's location is the thing you are protecting, re-encode it locally with the Image Compressor instead, which draws through a canvas and therefore keeps no metadata at all.

Passwords

1. Length, not character classes. NIST now requires at least 15 characters for a password used as the only factor, and prohibits composition rules outright². Sixteen random characters or six random Diceware words.
2. Unique per account. The realistic attack is not cracking your password. It is a credential from a service you forgot about in 2019, tried against everything else.
3. In a manager. One passphrase you remember, the rest you do not.
4. Passkeys where offered. They are bound to an origin, so phishing stops working rather than becoming harder.
5. Second factor from an app, not SMS. SIM swapping is routine.
6. No scheduled rotation. NIST prohibits requiring it without evidence of compromise², because it produces predictable increments.

Our Password Generator uses crypto.getRandomValues in the page. Our Password Strength Checker reports charset entropy and flags a few obvious patterns, and it will overrate a human-chosen password that happens to use all four character classes, so treat a low score as conclusive and a high one as unproven. The reasoning is in Password Strength in 2026.

Sending something sensitive

The pattern is the same whatever the tool: encrypt the payload, send it through any channel you like, and send the passphrase through a different one. A phone call, a text, an in-person handoff. Compromising the email thread then gets an attacker one half of the thing.

Our AES Encrypt/Decrypt derives its key with PBKDF2-HMAC-SHA256 at 600,000 iterations over a fresh random salt, which is exactly the figure OWASP currently recommends¹, and defaults to AES-256 in GCM mode so tampering fails loudly instead of decrypting to garbage.

It encrypts text, not files. A passphrase, a key, a block of notes, pasted into a box and returned as base64. For an actual document, use an archive tool with AES-256, or age, or an encrypted disk image. That is a real limitation and the previous version of this guide papered over it.

Whatever you use, the passphrase is still the weak point. Six hundred thousand iterations buys time against guessing; it does not rescue a phrase someone can guess.

Documents, honestly

A black rectangle is not redaction. The text stays in the content stream underneath, selectable and searchable, and anyone you send the file to gets it. Remove the content, do not cover it.

Metadata names you. A PDF exported from an office suite carries the author name, usually the operating system account, plus the organisation, timestamps and the software version. Do not assume a processing step removes it; check the output.

PDF passwords vary enormously. Modern PDF 2.0 files use AES-256 and are sound. Older ones use RC4 at 40 or 128 bits and are not, and you generally cannot tell which you are getting. Encrypting the document separately is more predictable.

EXIF carries GPS. Phone photos record where they were taken. Re-encoding through a canvas drops it, which is what the local Image Compressor does as a side effect.

Screenshots capture more than you meant. Notification previews, a second monitor, an open tab title. Look at the whole frame before sending it.

Browser hygiene

• A browser that defaults to blocking. Firefox with strict protection, or Brave. Safari is reasonable.
• Fewer extensions. A content script gets direct DOM access to every page matching its patterns³, which includes reading anything you type into a form. Extension supply-chain compromises are recurrent, and the December 2024 campaign covered in Never Paste This Into a Random Online Tool exfiltrated session tokens from pages users had simply left open.
• Containers or profiles to keep work, personal and shopping identities from sharing cookies.
• Private mode is not privacy. It withholds local history. The site and your network still see everything.

Verifying what you download

Publishers post a SHA-256 for installers and images so you can confirm you got the file they published rather than a mirror's version of it.

sha256sum downloaded-file.iso

Compare it against the hash on the publisher's own HTTPS page. Our Hash Generator does the same in the browser, with the file staying local, which is convenient for one file and slower than the command line for a big one.

Compartmentalisation, the underrated one

Separate email addresses per domain of life. Separate payment cards or virtual cards per merchant. Separate browser profiles per persona. A separate machine for the most sensitive work, if it warrants one.

Nobody does all of it. Each piece is independently useful, because the point is not preventing every leak but stopping one leak from becoming all of them.

The short list

• Password manager, used for every new account.
• App-based second factor on email, banking and work.
• Tracking protection on, extensions reviewed and pruned.
• Network tab checked before anything sensitive goes into a web tool, ours included.
• Encrypted payload and passphrase sent through different channels.
• Metadata checked before a document leaves the building.
• A quarterly pass to close dead accounts.

What privacy actually is

Not secrecy. Control over who knows what, in what circumstances, and it does not have to be airtight to be worth doing. Fewer incidental exposures, thinner aggregate profiles, and faster recovery when something does go wrong.

The tools linked here mostly run in your browser, and now you have a list of the ones that do not. That distinction is the whole point: a claim you can check in thirty seconds is worth more than a page of assurances, and it is the habit that carries into every other tool you use.