I put my own "no-upload" tools on a network monitor. Here's what actually left the browser.
"Runs in your browser, nothing uploaded" is the easiest claim in web tooling to make -- and one of the easiest to fake. A tool can pretty-print your JSON locally and quietly POST it to a server for "analytics." The only way to know is to watch the network. So I did that to my own tools. I opened 15 of them across nine categories with the browser's network panel recording every request, and wrote…
The author conducted an experiment to assess what data, if any, is transmitted when using various browser-based tools. To do this, they opened 15 tools across nine different categories using a web browser's network monitoring feature. Their findings were organized into three tiers based on the level of data transmission each tool performs.
Tier 1, which comprised nine of the 15 tools, was found to be entirely local. These tools processed data locally without sending any information to external servers. For instance, a CSV converter, Base64 encoder, and PDF splitter all handled their tasks using only the site's own resources, with no network requests to any other origin.
Tier 2 included three tools that required obtaining data from external sources, but did so using same-origin proxy techniques. This involved the browser communicating only with the host's own /api/* endpoints. An edge worker fetched data from external sources, such as NASA or an IP-lookup service, and relayed the results back to the browser. The user's IP and query remained hidden from the third-party service, which only saw the request's origin as the host itself.
Tier 3 involved three tools that directly contacted external hosts to retrieve public data. These included tools that accessed earthquake feeds, ISS positions, and currency tables. In each case, the tools made requests to public APIs and processed the data locally, ensuring that no personal information was shared with third-party services. The currency conversion tool, for example, downloaded the day's rate table once and performed the conversions locally.
The author emphasizes that the claim "nothing leaves your browser" is not universally accurate for all browser tools. They caution that some tools necessitate data transmission for their functionality, such as weather lookups, DNS lookups, plant identification, voice dictation, and contact form submissions. Although these exceptions exist, it is crucial that they are clearly enumerated rather than hidden, ensuring transparency and maintaining user trust.
The experiment concluded with one non-origin host appearing in the local tools: static.cloudflareinsights.com, which is Cloudflare's Web Analytics. The host is cookieless and only records page URL, screen size, and load timing, not the contents of the tools. The author included this information to provide a comprehensive view of the data interactions occurring within the browser.
In conclusion, the author encourages developers and users to rely on the Network tab in browser tools to identify data transmissions accurately. They also suggest providing detailed lists of exceptions when building browser tools, as this fosters transparency and trust. By employing these practices, users can better understand what data is being shared and make informed decisions about the tools they use.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
