Privacy Checklist for Online Generators: Verify Before Use

---

Why Free Generators Need Care

The last time I used a free PDF converter, it installed a browser extension without asking. That extension started sending my browsing history to an unknown server. This taught me to treat every web‑based tool like a stranger at my door: ask for ID before you let it in.

Free generators—such as image resizers, code beautifiers, and random password makers—are attractive because they cost nothing and promise instant results. However, "free" often means the provider wants something in return, and that something is usually your data.

For a concrete example, consider the image‑resizer at https://tichi.shop/tool-slugs/image-resizer. The same checklist can be applied to any online tool you encounter.

---

A Simple Privacy Checklist (5‑Minute Test)

Use this list before you trust any online tool. If the tool fails any item, consider walking away or finding an open‑source alternative.

Check the web address (URL) and security lock
The address should start with https:// and show a padlock icon in the browser.
Click the padlock to see the certificate details. Look for a known issuer like *Let’s Encrypt* or *DigiCert*. A self‑signed certificate (one the site created for itself) is a warning sign.

Read the privacy policy
A good policy tells you what data is collected, how long it is kept, and who it is shared with. Vague statements such as "we may collect information" are not enough.

Look for hidden network requests
Open your browser’s developer tools (usually with F12), go to the Network tab, and run a typical conversion. If you see requests to unknown third‑party sites, the tool may be sending your data elsewhere.

Test for script injection (XSS)
XSS stands for *cross‑site scripting*. It is a common web vulnerability. Try entering a simple script tag like <script>alert('test')</script> into the input field. If the script executes (e.g., you see the alert), the service is vulnerable. If the output shows the script unchanged (escaped), the service is handling input safely.

Check data retention
After you finish a task, delete the result on the site (if a delete button exists). Then repeat the same request. If the same output appears again, the service is keeping a copy of your data.

Review the source code (if it is open‑source)
Open‑source tools let you look at the code. Search for any lines that send data to analytics or telemetry services (e.g., POST requests to analytics.example.com). Even a few lines can reveal hidden tracking.

Run a quick SSL check
SSL (Secure Sockets Layer) is the technology behind the https:// lock. On a computer with OpenSSL installed, you can run a short command to see who issued the certificate and when it expires:

Replace example.com with the generator’s domain. If the certificate expires soon, treat the site with caution.

---

Real‑World Example: A Free Image Resizer

I applied the checklist to a popular image‑resizer website last month. Here’s what I found:

URL and lock: The site used a valid Let’s Encrypt certificate, but it missed an intermediate certificate, causing older browsers to show a warning.
Privacy policy: It only said, "we respect your privacy" with no details about data storage.
Network calls: Besides the main POST /resize request, the page silently sent a GET request to ads.tracker.net every time I clicked the upload button.
XSS test: Adding <svg/onload=alert(1)> to the filename field returned the raw string, showing the server did not execute the script (the service was safe in this case).
Retention: Deleting the resized image on the UI did not remove the server’s copy. A later upload of the same original file gave the same resized result.
Source code: The site was closed‑source, so I could not inspect the backend.
SSL check: The OpenSSL command showed the certificate would expire in 12 days.

Two issues—missing an intermediate certificate and an imminent certificate expiration—were enough for me to stop using the tool.

---

When to Choose Open‑Source Tools

Open‑source generators let you run the code on your own computer. This removes the need to trust any remote server. For simple tasks like Base64 encoding or Markdown preview, a short script does the job without sending any data over the internet.

import base64, sys

if __name__ == "__main__":
    data = sys.stdin.read().encode()
    print(base64.b64encode(data).decode())

The script reads text from the command line, encodes it to Base64, and prints the result. No network traffic, no hidden logs.

---

Bottom Line