Ask a developer how that Base64 string got decoded, or a student how the lecture PDFs got merged, and the answer is usually a free tool in a browser tab. It's quick. It also got expensive in late 2025, when two formatting sites exposed years of pasted passwords and one bad file at Cloudflare took much of the web offline for about three hours.
Is a given tab safe enough for the job in front of you? Five quick tests, run before you paste anything, usually settle it. They're ranked by what failing them is likely to cost, with the most expensive first.
A Base64 decoder written in JavaScript or WebAssembly can run entirely inside your tab without the string ever leaving your laptop. Plenty of online PDF compressors instead upload your file to a server and send back the result. On screen, the two look almost identical, which is why this test comes first.
The cost of guessing wrong went public in November 2025, when researchers at watchTowr Labs pulled more than 80,000 saved submissions out of two code-formatting sites, JSONFormatter and CodeBeautify. A save button on each site created a shareable link, and a public Recent Links page listed those links for anyone who scrolled.
The haul ran past 5GB and included Active Directory passwords, cloud keys and identity-check records from a bank. The researchers also saved fake AWS keys in a snippet set to expire after 24 hours. Someone tried those keys about 48 hours after upload.
You can check a tool in about a minute. With the page loaded, switch off Wi-Fi and run a harmless sample through it. An answer that still comes back points to processing in your browser, and a spinner that never stops usually means a server is involved. If a tool offers to save a shareable link, assume a server keeps a copy.
For teams, two habits help most. Keep a short list of utilities that have passed this check, and treat any secret pasted into an unchecked tool as exposed, which means rotating it the same day. Leaked credentials tend to outlive the mistake, and GitGuardian's State of Secrets Sprawl 2026 report found that 64% of valid secrets it detected in 2022 were still active about four years later.
Server-side tools aren't a bad choice in themselves, and jobs such as AI summaries need one. They just shouldn't receive passwords, keys or other people's personal data until you know where that input goes.
Free utility sites have servers to pay for, and ads usually cover the bill. On many free converters, the tool gets less screen space than the ads around it, including an oversized Download button that leads to someone else's software.
Third-party scripts on a page can see more than most users expect. Researchers from KU Leuven and Radboud University found trackers collecting email addresses typed into forms before anyone pressed submit on 2,950 sites in their US crawl, and session-replay scripts picked up passwords on 52 sites. An ad in its own frame generally can't read what you paste, but a script placed directly in the page usually can.
Clearing that layer away before you judge a tool costs nothing. Adblock Plus for Browsers is free, and a single download page carries versions for Chrome, Firefox, Safari, Edge and Opera, handy when your work laptop runs Edge and your home PC runs Firefox. Out of the box, it lets Acceptable Ads through, and that's one checkbox to untick if you'd prefer a page with none.
Ad slots also carry the fake download buttons that lead to unwanted installers. In 2025, Google ads steered people to a fake PDF editor called AppSuite PDF Editor, which looked harmless for about eight weeks before switching on an infostealer in late August.
With ads blocked, check what remains. A tool that stops working once ads are blocked depends on those ads, which is worth knowing before you hand it a file. Permission requests need the same scrutiny, since a webcam test has a reason to ask for your camera and a JSON formatter doesn't.
Requests to install a companion extension call for the most caution. A Stanford and CISPA study of the Chrome Web Store estimated that over 346 million users installed security-noteworthy extensions in about three years, and malware-laden ones stayed listed for roughly a year on average. A quarterly review that removes unused extensions is a cheap control for any IT team.
A web tool that remembers your draft usually keeps it in local storage, inside that one browser profile. Open the same link on your phone and the box comes up empty. Few tools explain this on the page.
Safari adds another limit. When Apple's WebKit team tightened tracking prevention in 2020, Safari began wiping a site's script-writable storage after seven days of browser use without interaction on that site, including localStorage and IndexedDB. Web apps saved to an iPhone or iPad home screen keep their own clock, but a bookmarked tool doesn't.
On a two-minute fix, storage hardly matters. Say a config file won't parse because someone indented it with tabs, which YAML doesn't allow. An online YAML editor is a quick way to find the broken line. Anything that takes an afternoon is safer in an app that saves to your own disk.
Can you download your work as a plain .csv or .json file without creating an account? A tool that says no keeps your data on its terms. Typing a test line and reloading takes five seconds and shows whether the page keeps what you typed.
Notepad opens with the router unplugged. A web converter won't, and it relies on a chain of other companies' systems, usually the site's servers plus a CDN or a cloud host such as AWS.
Late 2025 tested that chain twice. Amazon's post-event summary describes a DNS fault that disrupted DynamoDB in its Northern Virginia region for close to three hours on October 20, with knock-on failures in services such as EC2 and Lambda.
Cloudflare's turn came on November 18. From around 11:20 UTC, a Bot Management file that had doubled in size stopped most core traffic from flowing through Cloudflare's network, and sites behind it showed error pages until roughly 14:30. Co-founder Matthew Prince called it the company's worst outage since 2019.
Some jobs lose little by living online because they need the network anyway. A tool for finding the IP address behind a website has to query DNS either way, as does an MX lookup. PDF export is another story, because Word's Save As dialog and LibreOffice's Export as PDF command both work offline. Uploading a .docx just to get a PDF adds an outage risk you didn't need.
Deadline week is a bad time to hunt for an offline alternative, so add one to the team runbook now. For documents, John MacFarlane's Pandoc turns report.md into report.docx with one command. ImageMagick covers image work, and neither needs a network.
Frequency is the least exciting test here. It also settles most borderline calls between a tab and an app.
Priya, an invented freelancer in Manila, decodes Base64 about twice a month, usually when an email attachment arrives as gibberish. For her, a bookmarked tab that passes the offline check will probably do.
Volume changes the picture. A small agency resizing a few hundred product photos a week will usually do better with an installed editor it can script. Remember the fake AppSuite PDF Editor? Five minutes spent verifying a download and scanning it for malware costs less than an infostealer cleanup.
Many companies restrict software installs, which can push staff toward web tools for the very jobs that involve company data. In 2023, a Samsung engineer uploaded internal source code to ChatGPT to hunt for bugs, and an April memo then barred the company's device division from using generative AI tools. Requesting an approved converter through IT is slower, though it leaves the company knowing where its files went.
Run the first test even if you skip the rest. A lost draft or a morning-long outage is a nuisance. Leaked keys are another matter, and the GitGuardian figures in the first section show that some stay valid for years after they first turn up in public. The other four mostly weigh convenience against smaller risks.
The check takes about five minutes. Ctrl+H opens your history in Chrome, Edge and Firefox, and a month of it will show most of the converters and formatters you've used. Tools that work with Wi-Fi off can stay bookmarked. Any password or API key that went into the others needs changing today, most recent first.