The Free 10-Minute Online Privacy Checkup: 7 Checks Anyone Can Do in a Browser (2026)

Most people treat online privacy like dental care — they know they should do something about it, but the job looks so big that they do nothing at all. Here is the good news: a meaningful privacy self-audit does not take an afternoon, cost money, or require installing anything. In about ten minutes, with nothing but your browser, you can test your passwords, spot phishing risks, see what your network reveals about you, and close several of the most common holes that real attackers and trackers exploit. This guide walks you through seven checks, in order, with free tools that run entirely in your browser and need no signup. Set a timer, work through them one by one, and fix whatever each check flags.

Check 1: Score the passwords you actually use

Start with the single biggest privacy lever you control: your passwords. Run your most-used password through the Password Strength Checker and look honestly at the result. If it comes back weak or moderate, it belongs on your replace list — and anything you reused across accounts is an even bigger problem, because one breached site exposes every account sharing that password. Do not only test your "important" password; test the one you use most often, since that is the one attackers are most likely to capture. For each weak or reused password, generate a fresh one with the Password Generator and save it in your browser's built-in password manager or a reputable password manager of your choice. Aim for unique, long passwords everywhere — length beats complexity every time, so a 20-character passphrase beats an 8-character jumble of symbols. If you want the full routine for building a system that lasts, read our guide on how to generate strong passwords online.

Check 2: Verify the login pages you trust

Phishing pages that copy your bank or email login screen are the most common way accounts get stolen — and they survive because people click links instead of typing addresses. Take the last "reset your password" or "verify your account" link you received, or any login page you use often, and run its URL through the Phishing URL Checker. The checker examines the URL's structure for the tricks phishing kits rely on: misspelled brand names, lookalike characters, suspicious subdomains, and URLs that claim to be one site while pointing at another. If a link you already clicked fails the check, treat that account as potentially exposed: change the password immediately (use the password generator from Check 1) and check the account's recent activity for logins you don't recognize. Going forward, make this your rule: for banks, email, and payment accounts, always type the address yourself or use a bookmark — never arrive through a link.

Check 3: See what your connection reveals

Your IP address is visible to every website you visit, and it can reveal your approximate location and your internet provider — information that feeds ad profiling, location-based tracking, and in some cases social engineering. Open the IP Lookup tool and see what it shows about you right now: your IP, approximate city or region, provider, and timezone. Ask yourself three questions: is the location shown more precise than you are comfortable with, is the provider your own or a shared one, and does this match what you expect (a mismatch can indicate a VPN is working — or that something else is routing your traffic)? You cannot change your IP address yourself most of the time, but knowing what is visible helps you decide when it matters: if the tool shows your real home city, think twice before posting that IP-attached screenshot or complaining about a service with your location embedded. Also notice that this check doubles as a leak detector — if you use a VPN, the lookup should show the VPN's location, not yours.

Check 4: Audit the security of the sites you run or use

You do not need to be a developer to spot a badly secured website. If you own a website, a blog, or an online shop, enter its address into the Security Headers Checker and read the result. Security headers are invisible instructions a site sends to your browser — things like "never load this page over an unencrypted connection" and "block pages that try to trick my visitors with clickjacking." A site missing several headers is easier for attackers to abuse, and if it is yours, that is your visitors' data at risk. The checker tells you which headers are present and which are missing, so you can forward the specific missing list to your developer or hosting provider with an exact request instead of a vague "make it more secure." If you don't run a site, use the checker on the smaller shops and services where you have accounts — and think twice about entering payment details on one that fails every basic header check.

Check 5: Hunt for reused and shared secrets

Passwords are not the only secrets people reuse. Take stock of the other credentials you typed into websites this year: the "secret answer" to security questions (your mother's maiden name is on public records), the same 4-digit PIN on your phone and your bank card, the birthday you use as a recovery date. Now do two things. First, for every site that still offers security questions, replace real answers with random strings — store them like passwords, because they are passwords. Second, if you ever need to share a file or text that contains sensitive details, hash it with the Hash Generator to create a fingerprint you can verify later: a hash lets someone confirm a file is unchanged without you sending the file itself, and it never runs on a server — everything happens in your browser. The rule of thumb is simple: anything an attacker could guess from your social media is not a secret, so stop treating it like one.

Check 6: Review what your browser hands out automatically

Every time you visit a website, your browser volunteers a surprising amount of information without asking you: your language, screen size, installed fonts, and device details. Combined, these can form a "fingerprint" that identifies you even without cookies. This check is a review, not a tool run: open your browser settings and do three things. First, clear cookies and site data for sites you don't regularly use — many trackers live in long-forgotten cookies from sites you visited once. Second, check which extensions can read all your browsing data; remove any you don't actively use, because each one is a third party with full access to your browsing. Third, look at saved logins in your browser's password manager and delete entries for accounts you closed. These three cleanups take about three minutes and remove the largest passive data trails most people carry.

Check 7: Lock down your recovery options

The final check covers the part everyone forgets: how you get back into your accounts. List your five most important accounts — email, bank, cloud storage, and the two you use for password resets everywhere else. For each one, verify three things: is two-factor authentication enabled, is the recovery email address still yours and still secure, and is the recovery phone number one you actually control? An account protected by a strong password but a stale recovery email belongs to whoever controls that old inbox. While you are there, download or print each service's backup codes and store them somewhere offline, like a drawer — if you lose your phone, those codes are the only way back in. Update anything stale now; future-you, locked out at the worst possible moment, will be grateful.

Make it a routine, not a one-off

Ten minutes today fixes today's problems; the privacy wins fade if you never repeat the exercise. Put a short reminder on your calendar — once a month is enough for most people, or once every three months at minimum. The routine shrinks each time because you are only checking for changes: new reused passwords, new saved logins, a recovery email that went stale when you changed jobs. Combine it with the email-proofreading habit of keeping sensitive drafts local: anything you type into a browser tool on this site never leaves your device, which is exactly the property you want in a privacy routine. Your future privacy is mostly the sum of small habits — and now you have the first seven.

Frequently asked questions

Do these checks send my data anywhere?

No. Every tool linked in this guide runs entirely in your browser — the password you test, the URL you inspect, and the text you hash never leave your device. That is a deliberate design choice: a privacy checkup that uploads your secrets to a server would defeat its own purpose.

How often should I repeat the checkup?

Monthly is ideal, quarterly is the minimum worth doing. Repeat Check 1 (passwords) and Check 7 (recovery options) most often, since credentials and recovery details go stale fastest.

Is ten minutes really enough?

For a baseline audit, yes. The seven checks cover the attack paths that affect ordinary users most: weak and reused passwords, phishing, exposed network data, insecure sites, guessable secrets, passive tracking, and stale recovery options. Deeper audits exist, but these seven fix the problems that cause the vast majority of account takeovers.

What should I fix first if everything flags?

Start with your email account — it is the key to resetting everything else. Secure it with a unique strong password and two-factor authentication (Checks 1 and 7), then work outward to banking and cloud storage.

Try it now: Free Password Strength Checker · Free Phishing URL Checker · Free Security Headers Checker · Free IP Lookup · Free Password Generator · Free Hash Generator · Strong Passwords Guide