Free tools and services for a do-it-yourself privacy checkup — explained like a friend would, no scraping, nothing creepy.
A friendly guide from Asdale Dynamics, LLC. Links verified live before this page was built. Nothing here needs an account for its core check unless noted.
Free tools and services you can use right now, no scraping and no accounts required for the core checks, to give your digital life a friendly once-over. Each entry has a friend-style one-liner and a plain-English note on what the tool actually inspects.
How to use this directory: pick a section, do the check, and move on. Nothing here is a scanned-and-judged "test" you can fail — these are tools that show you your own data so you can decide what to tighten. Links were verified live before this directory was built; see check_links.py in this repo if you want to re-verify them yourself.
Not included on purpose: data-broker removal walkthroughs (see our separate guide), step-by-step password and two-factor setup (separate guide), and the link-safety-inspector CLI tool (separate tool). This directory is the checkup, not the treatments.
See how a password would hold up before you use it for real.
security.org
Type a password, get a blunt-but-nice estimate of how long a cracker would need — in your browser tab, at zero cost, in about five seconds.
What it actually inspects: Length, character mix (upper/lower/digits/symbols), and dictionary/common-password patterns, then simulates brute-force crack time against typical offline attack speeds.
bitwarden.com
The same folks behind a popular password manager let you poke at a password with a real zxcvbn-style entropy score, no account needed.
What it actually inspects: Estimated entropy (guess attempts vs. offline-cracking scenarios) using common dictionary and keyboard-pattern matching — the modern "cleverness" scoring, not just "how many symbols did you add."
passwords.google.com
If you're signed into a Google account, this quietly cross-checks all your saved passwords at once — reuse, weakness, and known breaches.
What it actually inspects: Every password in your Google-saved list against reuse, length/strength heuristics, and a continuously updated list of leaked credentials (via a privacy-preserving hash comparison).
Note: Requires a Google account sign-in (that's the one in this section that does). There's a similar built-in check in Chrome's and Android's settings.
Find out which leaks your email has already been part of.
haveibeenpwned.com
The granddaddy of free breach checks — pop in your email and find out which data leaks have contained it over the last decade.
What it actually inspects: Your email address (not much else) against hundreds of publicly grouped corporate and organizational data-breach dumps, listing service names and dates of exposure.
monitor.mozilla.org
Firefox's friendly take on the breach check — powered by the same leak databases, with ongoing monitoring if you're willing to make a (free) account later.
What it actually inspects: Email address exposure in the same public breach datasets, but presented with clear, low-panic next-step advice for each one.
Note: This site politely refuses bare automated requests on principle; open it in a browser and it works exactly as expected.
Give every service a different address; turn off the noisy ones.
relay.firefox.com
Generate throwaway-but-still-routable email addresses on demand so each service gets its own alias, and your real inbox stays the only one you actually check.
What it actually inspects: Nothing sneaky — it forwards mail from each alias to your real address and lets you switch an alias off if a service starts spamming; the paid tier adds a mask for phone numbers too.
Note: Core aliasing has a free tier; sign-up creates a Mozilla account (free).
duckduckgo.com
A free @duck.com address that secretly strips trackers from every email it forwards — basically Relay and a tiny privacy shield in one.
What it actually inspects: Incoming mail only, and only to remove tracking pixels and tracking redirects; it doesn't read or store your message contents beyond that.
Note: Requires one free account setup, and the browser-extension route makes aliases a two-click affair while you're signing up for things.
addy.io
A power-user-friendly alias maker with a very generous free tier — you can create a lot of aliases and even reply to them without revealing your real address.
What it actually inspects: It doesn't scan your mail; it simply forwards from a random-or-custom alias to your real inbox and lets you disable or delete aliases that start misbehaving.
Note: Free tier covers the core aliasing; a free account is required to manage aliases.
simplelogin.io
The cleanest, most self-hostable aliasing service around — free tier included — with aliases, blur, and a searchable alias log.
What it actually inspects: Only what it must: which alias received mail and where to forward it (it logs delivery, not content). Proxies replies the same way so your real address never shows.
Note: Free tier allows a small number of aliases; a free account is required.
See how unique — and visible — your browser really is.
coveryourtracks.eff.org
See for yourself how unique your browser's fingerprint is — and whether your "do not track" setting is being politely ignored.
What it actually inspects: Canvas and WebGL fingerprinting, installed-font fingerprinting, HTTP-header traits, ad-blocker effectiveness, and whether Do Not Track signals are honored, then tells you how unique your combo is among its visitors.
amiunique.org
A research-project-turned-tool from actual academics that shows which of your browser's quirks make you practically one-of-a-kind online.
What it actually inspects: A long list of readable browser traits (canvas, fonts, plugins, screen size, hardware hints) and compares your fingerprint against a large collected dataset to estimate your uniqueness.
browserleaks.com
A pixel-perfect rundown of every browser feature that can leak data — canvas, WebGL, IP, WebRTC, geolocation API, and more, each with its own mini-test.
What it actually inspects: A wide battery of individual leak tests (canvas, WebGL, WebRTC, time zones, domains exposed to JavaScript, etc.) so you can spot exactly which single feature is the loud one after you tweak settings.
dnsleaktest.com
Changed your DNS but not sure it took? This check shows which DNS servers your requests are actually using — including your ISP's if they're sneaking in.
What it actually inspects: Generates randomized test hostnames and observes which recursive resolvers answer them, revealing your real resolver set (and whether your VPN's DNS routing is honest).
ipleak.net
See your "public self" as the internet sees you: IP, DNS servers, WebRTC-exposed addresses, and rough geolocation, all on one friendly page.
What it actually inspects: Your apparent public IP as seen by the test's servers, plus DNS resolution paths and browser-exposed WebRTC addresses that could betray your real IP even behind a VPN.
Stop your ISP from keeping a diary of the sites you look up.
quad9.net
A free, no-log DNS resolver (9.9.9.9) run by a not-for-profit that blocks known-malicious domains as a bonus — privacy and safety in one red herring-free box.
What it actually inspects: (While resolving) — it matches requested domains against malware/phishing blocklists; queries are not stored in a way that can identify you personally, per its published policy.
one.one.one.one
Swap your ISP's logging DNS for one that promises to log almost nothing and erase it fast — and it genuinely feels faster.
What it actually inspects: (While resolving) — it processes every domain you look up; its policy says it discards identifying IP data quickly and sells nothing. Easy to set in seconds on most routers and phones.
Check your front door from the outside, like a stranger would.
routersecurity.org
A friendly, opinionated checklist that walks you through your router's settings like a patient friend who happens to know way too much about routers.
What it actually inspects: Nothing automatically — it walks you through manually inspecting admin passwords, Wi-Fi encryption (WPA3/WPA2 not WEP), firmware versions, remote administration, and UPnP behavior.
grc.com
The internet's longest-standing "knock on your front door" test — it probes your router's exposed ports from the outside and reports which ones answered.
What it actually inspects: Whether your network's common ports (and chosen ranges you pick) respond to unsolicited connections from the outside — the modern "is my router silently exposing something?" test.
yougetsignal.com
A dead-simple outside-in port tester: pick (or use) your IP, enter a port, and see whether anything on your network answered the door.
What it actually inspects: Whether a given TCP port on your public IP accepts connections, which is exactly how port-scanners and accidental ransomware find exposed devices.
Plain-English walkthroughs of the settings worth reviewing.
myaccount.google.com
Google's own guided tour through your account's security: signs you in, shows recent device logins, third-party app access, and two-step status.
What it actually inspects: Signed-in devices, recent security events, compromised-password hints, app passwords, and third-party apps granted scopes on your Google account — all on Android or any browser, free.
myaccount.google.com
Ten-tips-in-one-screen: pulls up every "is Google saving this?" toggle (activity types, ad personalization, shared defaults) so you can flip each of them consciously.
What it actually inspects: Your current activity-saving and ad-personalization settings across all Google services on one screen, with plain explanations of what each toggle really controls.
support.apple.com
Apple's official step-by-step walkthrough of iPhone settings worth checking — safety-focused, calm, and written so a non-techie can follow every tap.
What it actually inspects: It walks you through manually reviewing sharing of location (Find My), app privacy reports, air tag/Tracker Detect checks, house-cleaning of message/plan subscriptions, and account recovery — as a checklist, not a scan.
apple.com
Not a test, a compass — Apple's plain-English summary of what its own devices collect, ideal as a companion while you poke around iPhone settings.
What it actually inspects: (Nothing — it's background reading.) Included because its app-tracking-transparency and privacy-feature summaries pair neatly with any phone-settings session.
ncsc.gov.uk
The UK's cyber-security agency boiled personal security down to six actions — short, kind, and very doable on any phone.
What it actually inspects: (Nothing — it's a walkthrough.) Suggests manually reviewing passwords, screen-lock, two-step setup, software updates, and account recovery steps; no account or scan needed.
No time for the whole page? This pass hits the highest-value checks: