Online privacy tool ratings
Websites that test for leaks, fingerprinting and breaches.
17 privacy test tools are rated against 9 public criteria, and 17 have enough evidence for a letter grade. Of the 14 with a known jurisdiction, 9 are based in a Five Eyes country, and 13 in the wider Fourteen Eyes.
Open-source privacy test tools only · Criteria for this category · Suggest an addition · Markdown
| Name | Grade | Score | Data | Jurisdiction | Open source | No trackers or telemetry | No ads or data sales | Independent audit | Transparency report | Tells users about requests | TLS configuration | Security headers | Modern web standards |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
EFF tool, formerly Panopticlick, that tests how well a browser and its extensions block tracking and how unique the browser fingerprint is. |
Grade C | 69 | 100% | United States Five Eyes | Yes | Yes | Yes | No | Partial | Yes | Partial | No | Not tested yet |
Open Rights Group tool that checks whether a website is blocked by the filters of UK mobile and broadband Internet service providers. |
Grade C | 66 | 100% | United Kingdom Five Eyes | Yes | Partial | Yes | No | Partial | Yes | Yes | No | Not tested yet |
Exodus Privacy's report site that analyzes Android apps and lists the trackers and permissions found in each one, with a report for every analyzed app version. |
Grade C | 66 | 100% | France Nine Eyes | Yes | Yes | Yes | No | No | No | Yes | Partial | Not tested yet |
Searches a database of data breaches to show whether an email address, phone number or password has been exposed, and can notify subscribers about new breaches. |
Grade D | 59 | 100% | Australia Five Eyes | Partial | Yes | Yes | No | No | No | Yes | Yes | Not tested yet |
Shows the IP addresses, DNS servers, WebRTC addresses, geolocation and browser details that websites can see, to check whether a VPN or proxy leaks. Run by AirVPN. |
Grade D | 47 | 100% | Italy Fourteen Eyes | No | Yes | Yes | No | No | No | Yes | Partial | Not tested yet |
Research site that collects a browser fingerprint from device and browser attributes and shows how unique it is compared with other visitors. |
Grade F | 34 | 100% | France Nine Eyes | No | Partial | Yes | No | No | No | Yes | No | Not tested yet |
Tests the security configuration of a domain, covering DNS, email, HTTPS, TLS, certificates and security headers, as a free public report and a paid monitoring service from Red Sift. |
Grade F | 31 | 100% | United Kingdom Five Eyes | No | No | Yes | No | No | No | Yes | Yes | Not tested yet |
Free service from Tines that analyzes a suspicious email forwarded to it, scanning its links with urlscan.io and replying with a report. |
Grade F | 25 | 100% | Ireland Outside Eyes | No | No | Yes | No | No | No | Yes | No | Not tested yet |
Traces the full redirect chain of a URL, such as a shortened or affiliate link, and shows where it ends without opening it in a browser. |
Grade F | 25 | 100% | – | No | No | Yes | No | No | No | Yes | No | Not tested yet |
Collection of browser tests that show which data a browser exposes to websites, including IP address, WebRTC and DNS leaks, TLS details and canvas, WebGL and font fingerprints. |
Grade F | 22 | 100% | – | No | No | Partial | No | No | No | Yes | Partial | Not tested yet |
Netcraft tool that reports what a website runs and where it is hosted, including its hosting provider, IP addresses, registrar, TLS certificates, web technologies and security risk. |
Grade F | 19 | 100% | United Kingdom Five Eyes | No | No | No | No | No | No | Yes | Yes | Not tested yet |
Removes EXIF, GPS, XMP, IPTC and other metadata from JPEG photos, processing the files in the browser without uploading them. |
Grade F | 16 | 100% | – | No | No | No | No | No | No | Yes | Partial | Not tested yet |
Generates a disposable email address that expires after ten minutes, for sign-ups where a real address is not wanted. |
Grade F | 13 | 100% | United States Five Eyes | No | No | No | No | No | No | Yes | No | Not tested yet |
Parses pasted email headers to show the delivery path, relay delays and SPF, DKIM and DMARC results, which helps check a message's authenticity and what outgoing mail reveals. |
Grade F | 13 | 100% | United States Five Eyes | No | No | No | No | No | No | Yes | No | Not tested yet |
Checks a website's reputation, domain age, blocklist status and other signals to estimate whether it is legitimate or a scam before buying from it. |
Grade F | 9 | 100% | Italy Fourteen Eyes | No | No | No | No | No | No | Partial | Partial | Not tested yet |
Google service that scans files, URLs, domains and IP addresses with many antivirus engines and URL scanners. Submitted files and reports are shared with security partners and premium customers. |
Grade F | 9 | 100% | United States Five Eyes | No | No | No | No | No | No | Partial | Partial | Not tested yet |
Database of Windows programs that rates whether each one is safe to remove, based on user uninstall data and what the program does, with an optional desktop scanner app. |
Grade F | 6 | 100% | United States Five Eyes | No | No | No | No | No | No | Partial | No | Not tested yet |
Questions
What is the most private option among privacy test tools?
No pick has been made yet. The table above is sorted by score, based on public evidence.
How are privacy test tools rated?
Each entry answers 9 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, security headers and modern web standards. Answers need links to evidence. See the full criteria.
Does jurisdiction matter?
Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.