The privacy tools that matter most are the boring ones: a password manager, a way to strip location data from photos, and a redaction tool that actually deletes what you black out. Below are 15 free tools from ToolAspect that run entirely in your browser, so your files never leave your device, plus four outside apps we'd recommend to anyone. Each comes with the catch we'd want to know ourselves.
Most privacy leaks aren't hacks. They're files that carry more than you think. Here's what typically rides along, and which tool clears it.
| File type | What it can reveal | Free fix |
|---|---|---|
| Phone photo (JPEG, HEIC) | GPS coordinates, date and time, phone model, sometimes a serial number | Image Metadata Remover |
| Word, Excel, PowerPoint | Author, "last modified by", company, total editing time, template path | Document Metadata Remover |
| Author, the software that made it, creation dates, an XMP block | PDF Metadata Editor | |
| PDF with "blacked-out" text | The text under the box, if it was only covered | Redact PDF |
| A QR code from a stranger | Where the link really goes before you open it | QR Code Scanner |
| A login token (JWT) | User IDs, email addresses and roles, readable by anyone | JWT Decoder |
All 15 of these process your file or text inside the browser tab. The page loads its code once, reads your file from your own disk, and hands you the result straight from memory.
| Tool | What it does | The catch |
|---|---|---|
| Image Metadata Remover | Strips EXIF and GPS from a photo and downloads a clean copy | Output is always a JPEG, so a PNG loses its transparency |
| EXIF Viewer | Shows camera, timestamps and GPS before you share | Reads the main EXIF and GPS blocks, not every maker note |
| Document Metadata Remover | Clears author, company, dates and custom properties from Office files and PDFs | Doesn't remove tracked changes or comments inside the text |
| PDF Metadata Editor | Views and rewrites a PDF's title, author and other fields | Edits the standard Info fields, not the XMP block |
| Redact PDF | Burns black boxes into page images so hidden text is really gone | The rest of the page stops being selectable text |
| Password Protect PDF | Adds AES-256 encryption with qpdf, locally | Lose the password and the file is gone too |
| Password Generator | Random passwords from your browser's secure random source | You still need somewhere safe to keep them |
| Password Strength Checker | zxcvbn score, guess count and crack times | Test a look-alike, not your real password |
| Hash Generator | MD5 to SHA-512 for text or a file, to check a download | MD5 and SHA-1 are fine for checksums, not for security |
| QR Code Scanner | Decodes a QR code and shows the link before opening it | Camera mode needs camera permission |
| Reverse Image Search | Sends a public image URL to Google Lens, Bing, TinEye and Yandex at once | The engines see the URL, so it's for images already online |
| PimEyes Alternatives | Free ways to check where your face appears online | No free engine sees the whole web |
| AI Image Detector | Checks a photo's metadata for camera data and AI-generator tags | Missing metadata proves nothing either way |
| JWT Decoder | Shows what's inside a login token | Decodes only, it doesn't verify signatures |
| Certificate Decoder | Reads a site certificate or CSR: issuer, expiry, domains | Paste certificates, never private keys you still use |
Open Image Metadata Remover, choose the photo and download the clean copy. The tool redraws the picture without its EXIF block, so GPS, timestamps and the phone model are gone. If you want to see what was there first, drop the original into the EXIF Viewer.
This matters more than people expect. Social networks usually strip location from what they show, but emailed photos, cloud share links and files sent through chat apps often keep it. A photo of your new sofa can carry your home's coordinates to a few meters. Our guide on removing location from photos also covers the built-in switches on iPhone and Android.
Office files record who wrote them, who last saved them, the company name from the software license and how long the document was open for editing. That's awkward when a CV still says it was written by your current employer's IT department.
Document Metadata Remover clears those properties from Word, Excel, PowerPoint and PDF files and gives you a clean copy. It doesn't touch the body, so accept or reject tracked changes and delete comments in Word first. For a PDF that needs a sensible title rather than a blank one, use the PDF Metadata Editor. And if a PDF has names or numbers that shouldn't be there at all, Redact PDF is the tool. Our guide to removing metadata from Word documents has the step-by-step for Word's own Document Inspector too.
No upload, no account. The photo is cleaned on your device.
Open Image Metadata RemoverQR codes on parking meters, restaurant tables and flyers are an easy way to send someone to a fake payment page, because you can't read the link by looking at the code. Most phone cameras show a preview of the address before opening it, but it's small and easy to tap past.
Our QR Code Scanner decodes the code and shows you the full text first, with a separate button to open it. Read the domain carefully. A parking app's real address won't end in an odd country code or have extra words bolted onto a brand name. If a code is stuck on top of another one, that's a warning sign on its own.
The same habit works for login tokens and certificates if you're a developer. The JWT Decoder shows exactly what a token reveals about a user, which is often more than people assume, since a JWT's payload is only encoded, not encrypted.
Partly. Our AI Image Detector reads the file's metadata for signs such as camera data, editing software tags and generator names. When those are present they're a useful clue. When they're missing, it tells you nothing, because screenshots, messaging apps and social networks strip metadata from real photos too.
For a picture of a person, a reverse search is often more revealing. Reverse Image Search checks four engines at once, so you can see whether the same image has been posted elsewhere under another name. Our TinEye alternatives guide compares what each engine is good at.
Some jobs need an app rather than a web page. These four are free, widely trusted, and cover what browser tools can't.
Long and random beats clever. A 16-character random password or a passphrase of five or six random words is out of reach for offline cracking rigs. Swapping letters for symbols, like "Tr0ub4dour&3", isn't. Our Password Strength Checker rates that famous example at about 41 seconds against a fast offline attack.
The bigger risk is reuse. One leaked password tried against your other accounts does more damage than any brute-force attack. That's why a password manager tops this list. For the numbers behind crack times, see what makes a password strong.
If you only do three things this week, set up a password manager, strip location from photos before you send them, and use real redaction when you black out a PDF. Everything else on this page is there for the day you need it. Bookmark it, and if you work with documents a lot, our best free PDF tools list pairs well with this one.
Open your browser's developer tools, go to the Network tab and run the tool on a test file. If the file is processed locally, you won't see a large upload request carrying it. You can also load the page, switch off Wi-Fi and try again. A tool that still works offline isn't sending your file anywhere.
The big platforms such as Facebook, Instagram and X strip location data from the copies they display. Email attachments, cloud share links, AirDrop and many messaging apps sent as files usually keep it. Stripping the metadata yourself before you share is the only way to be sure.
No. A box drawn on top leaves the original text in the file, so anyone can copy it out or delete the box. Real redaction removes the content underneath. ToolAspect's Redact PDF rebuilds each page as an image with your boxes burned in, so the hidden words no longer exist in the file.
It's better not to, even with one that runs locally like ours. Test a password built the same way, with the same length and kind of characters, rather than the real thing. If you want to know whether a real password has leaked, Have I Been Pwned's password check is designed for that and never receives the full password.
A password manager. Reused passwords cause more account takeovers than anything else on this list, and Bitwarden's free plan stores unlimited passwords on unlimited devices. After that, stripping location data from photos before you send them is the habit that catches people out most often.