There's no such thing as a free online tool. There's only a difference in what currency you're paying with, and most of the time nobody tells you the exchange rate.
That's not a rhetorical flourish, it's a description of an actual balance sheet. Servers cost money. Bandwidth costs money. Someone on a payroll somewhere maintains the code so it keeps working after a browser update breaks something. A tool with no visible price tag still has real operating costs, and those costs get paid by somebody. If it isn't you, directly, then the payment is happening somewhere else in the transaction, usually somewhere you can't see it happening.
The three ways a free tool actually gets paid
Strip away the marketing language and there are really only a handful of mechanisms that fund a tool nobody's charging you for, and it's worth naming them plainly instead of gesturing vaguely at "ads."
The first is straightforward advertising, banner and video inventory sold against your attention while you wait for a file to process. That one's honest enough, most people understand the trade even if they don't love it. The second is behavioral profiling folded into that same ad layer: not just showing you an ad, but building a profile of what kind of person converts PDFs at 11pm on a Tuesday, cross-referencing that against other sites you've visited through shared tracking pixels, and selling access to that composite profile rather than just the ad slot itself. The third, and the one people underestimate most, is direct data brokering, where the content you feed into a tool, or metadata about your usage of it, becomes a product sold to a third party you've never heard of and never agreed to deal with.
None of these are hypothetical. Avast, the antivirus company, spent years marketing its free software specifically on privacy and tracking protection while its Jumpshot subsidiary quietly sold browsing data collected through that same software to more than a hundred third parties, including advertising conglomerates and consulting firms. The Federal Trade Commission's 2024 complaint described data feeds granular enough to include precise timestamps and a persistent identifier per browser, information the agency said was detailed enough to reveal a person's health concerns, political leanings, and religious beliefs. Avast paid $16.5 million to settle the case. The product had, at various points, over a hundred million users who installed it explicitly because it promised to protect them from exactly this kind of tracking.
That case is useful specifically because it wasn't a shady operation running out of someone's garage. It was a major, publicly traded security company, and the mechanism wasn't a hack or a breach. It was the intended business model, running quietly underneath a publicly stated privacy promise for six years before anyone outside the company was in a position to stop it.
The other failure mode: the tool that changes hands
There's a second pattern worth naming separately, because it doesn't require any bad intent at launch. A developer builds something genuinely useful, gives it away for free because they mean it, and it accumulates millions of users precisely because it's good and costs nothing. Eventually, maintaining infrastructure for that user base without revenue becomes unsustainable, or the developer simply moves on, and ownership transfers to someone else.
The Great Suspender, a Chrome extension that put unused browser tabs to sleep to save memory, followed exactly this arc. It built a loyal following of over two million users on the strength of being free, lightweight, and open source. When the original developer sold it in mid-2020, the new owners pushed an update that executed arbitrary remote code, used for tracking and advertising fraud, without informing a single one of those two million users that anything had changed. Google eventually force-disabled the extension across everyone's browsers and flagged it as malware. The tool itself hadn't gotten worse at the thing it originally did. The ownership underneath it had simply changed, and the new owners monetized a captive user base that had never agreed to be sold along with the codebase.
This is the part that a privacy policy, however sincere at the moment you read it, can't actually protect you from. A privacy policy describes today's intentions. It says nothing about who owns the tool in three years, or what that owner decides your data is worth once the original team is gone.
"I'm not important enough to be worth profiling"
This is the honest objection, and it deserves a direct answer rather than a dismissal, because on an individual level it's not entirely wrong. Nobody at a data brokerage is personally curious about your specific PDF conversion history. The value was never in you as an individual case. It's in you as one data point inside a dataset of millions, and datasets at that scale are valuable in ways a single record never could be.
An aggregated, granular record of what millions of people are searching, converting, calculating, and typing into free tools is exactly the kind of raw material that trains ad-targeting models, builds audience segments sold to advertisers by demographic and intent, and increasingly, feeds the large language models and AI products that are hungry for exactly this kind of real, high-volume, real-world text and behavior. You don't need to be interesting as an individual for your data to be valuable in bulk. That's precisely the calculation the Jumpshot business model was built on: no single browsing history mattered, but eight petabytes of them, sold in aggregate to over a hundred buyers, mattered enormously.
There's also a narrower, more immediate risk specific to tools that process content rather than just track behavior. A word counter, a PDF converter, a JSON formatter, an image resizer, these all require you to hand over the actual content, not just metadata about your visit. If that tool's architecture routes your file or text through a server before returning a result, that content existed, even briefly, somewhere outside your own machine. For most casual uses that's a low-stakes trade. For a contract you haven't signed yet, draft financial figures, an unpublished manuscript, or an internal API key sitting inside a JSON payload you're trying to format, it's a materially different risk, and it's one almost nobody stops to consider in the moment, because the tool asked for nothing more than a copy-paste.
What actually changes the architecture, not just the promise
Here's the distinction that matters more than any privacy policy: whether an operation happens on a server you don't control, or entirely inside your own browser tab. This isn't a matter of trusting a company's stated intentions. It's a verifiable, structural fact you can check yourself, the same way you'd check anything else technical. Open your browser's developer tools, watch the Network tab, and run the operation. If no request fires carrying your content anywhere, it didn't leave your machine, regardless of what any policy document claims either way.
That's the specific design constraint we've built our own utilities around, not as the point of this piece, but because it's the direct antidote to everything described above. Our Word Counter, Text Analyzer, JSON Formatter, and Local Image Converter all run their processing as JavaScript executing in your own browser tab. There's no account to create, which means there's no account to eventually get acquired along with its user data, and no server-side log of what you pasted in, because there's no server-side step in the operation to log. It's a smaller promise than most privacy policies make, and that's deliberate. We're not asking you to trust a policy. We're pointing at an architecture you can inspect yourself in about thirty seconds.
How to actually evaluate the next free tool you use
Skip the privacy policy as your first check, since it's the easiest document on the page to write generously and the hardest one to enforce later. Open developer tools instead, watch the Network tab while you run the tool once, and see whether your input actually travels anywhere. Ask whether the tool requires an account for something that doesn't functionally need one, since an account is what turns anonymous usage into an attributable, sellable profile. Look up who currently owns the tool, not just who built it originally, since an acquisition history is often the more honest predictor of what happens to your data next than anything currently posted on the site. And for anything genuinely sensitive, a contract, unpublished writing, financial figures, source code with real credentials in it, treat "processes in your browser, verifiably" as a hard requirement rather than a nice-to-have, because that's the one property in this entire list that isn't dependent on trusting anyone's promise, present or future.
The tool was never actually free. Once you know which of those three currencies you were paying in, the rest of the decision gets a lot easier to make on purpose instead of by accident.