Browser-based tools removed a real friction from everyday work. You no longer need admin rights, a licence, or a twenty-minute install to convert a file or clean a list. The trade-off is that you are handing a stranger's server a document that may contain a client's name, an employee's salary, or a contract that has not been signed yet.
Most free tools are fine. Some are not. These seven checks separate them, and none of them takes longer than a minute.
1. Does the work happen in your browser or on their server?
Many text tools never send your data anywhere - the processing happens in JavaScript on your own machine. Others must upload, because the work genuinely requires a server. Neither is wrong, but you should know which one you are using. A tool that processes locally should say so plainly, and you can verify it: disconnect from the internet after the page has loaded and see whether the tool still works.
2. How long are uploaded files kept?
Look for a specific, short answer: "deleted immediately after processing", "purged within one hour". Vague phrasing like "we do not keep your files longer than necessary" tells you nothing. If a retention period is not stated anywhere, assume the files are kept.
3. Is there a real privacy policy?
Not a two-paragraph placeholder - an actual policy that names what is collected, why, on what legal basis, who it is shared with, and how to request deletion. A site running ads without a privacy policy that mentions advertising cookies is a site that is not paying attention to its own obligations, which tells you something about how it handles yours.
4. Does it demand an account for a simple task?
Requiring signup to remove duplicate lines is a signal that the product is list-building, not deduplication. For a one-off task, a tool that works without an account leaves less of a trail.
5. Is the connection encrypted end to end?
Check for HTTPS on the page itself, and note that the download link for your result should be HTTPS too. A result served over plain HTTP, or from an unrelated domain, is worth backing away from.
6. Can the result be guessed by someone else?
If your finished file lives at a predictable URL - /output/1.pdf, /merged/2.pdf - anyone can iterate through those numbers. Good tools use long random filenames and block directory listing so files cannot be browsed. You can test this in five seconds: remove the filename from the URL and see whether you get a file listing or a 403.
7. What does your own policy say?
This is the one people skip. Many organisations have rules about uploading client data to third-party services, and those rules apply to a free web tool exactly as they do to a paid SaaS product. If you are handling data under an NDA, a data-processing agreement, or sector rules such as HIPAA, the right question is not "is this tool trustworthy?" but "am I allowed to use any external tool for this file at all?"
Three habits that reduce the risk
- Redact before you upload. If only the layout matters, strip the sensitive values first.
- Use sample data to evaluate. Try any new tool with a dummy file before you trust it with a real one.
- Keep a shortlist. Two or three tools you have already vetted beats searching for a new one under deadline pressure, which is exactly when people skip the checks.
We hold ToolBox Hub to the same list. Our tools work without an account, files are deleted as soon as processing finishes, upload folders cannot execute scripts or be browsed, and our privacy policy states plainly what we collect and why. If anything on this page is ever untrue of us, we would rather you told us - you can reach the team through our contact page.