/ VERIFY

Check it yourself

This page does not ask you to trust us. It asks your own browser to prove that inyourbrowser.com keeps every file you process on your own device. Every check below works without opening developer tools.

1. Watch your browser stop a data request

The button below asks your browser to send a request to example.com. The browser refuses, because this site instructs it to block this kind of request. The actual message your browser returns will appear after you click.

2. See the live count of requests to other sites

This is the bigger version of the small counter in the corner of every page. The left number is how many requests this page has sent to other websites since you loaded it; the right number is how many such requests your browser blocked, counted from the moment the page started loading. Both numbers should be zero, unless you just clicked the demo above: each click adds 1 to “blocked”.

Both numbers come from records your browser keeps for this page: what the page loaded or sent (images, scripts, styles, fonts and data requests) and what its security policy blocked. That is also their limit. They do not count:

• requests to inyourbrowser.com itself, such as loading this page’s code and fonts;
• things the browser refuses that are not requests, such as a browser extension trying to run its own code inside the page;
• WebRTC connections, lookups, connections and background requests made through link hints, and the page moving this tab to another address or opening a new tab;
• requests made inside a background worker; or
• anything your browser sends on its own, such as page content for a built-in AI assistant, or the addresses you visit for history sync.

The count starts again at zero on every page you open.

3. See what is stored on your device

The panel below reads directly from your browser, right now. It shows the cookies, local and session storage keys, databases and service workers this site has put on your device, and in Chrome and Edge any other site storage. The list is almost always empty. There are at most two entries: theme (your light/dark preference) and nc_dismissed (whether you closed the floating request counter).

It cannot show what your browser keeps for itself, such as your history, its list of downloads, or what it saves so it can restore a tab. The privacy policy explains what the site does about those and what your browser may still keep.

What else your browser enforces here

Besides blocking requests like the one above, every page has your browser enforce three more rules. It may run only this site’s own scripts: each page lists the exact inline scripts it was built with, so a script added later is refused. Code on the page may not write raw markup into it (Trusted Types, in current browsers). And in current browsers, an attempt by the page to move this tab to another site is cancelled. The technical guide shows how to check each one.

What about the camera?

The QR code scanner can use your camera to scan QR codes in real time. The camera turns on only after you click “Start camera”. Video frames are decoded inside your browser and discarded immediately; nothing is recorded or transmitted. The same defences above apply to the camera stream.

What if you do not trust the buttons on this page?

Open your browser’s developer tools and check directly. The technical guide walks through the exact tabs, commands, and what each one means.

Read the technical guide for developers→

What this page does not, and cannot, prove

• The checks above prove that your browser is currently behaving as described. They do not prove that the site cannot change in the future. Re-reading the response headers (the technical guide explains how) is the quickest way to spot a relaxed policy.
• A few ways a malicious script could still send data out are not blocked, and they do not show up in the counter. They include a new tab opened the next time you click on the page, a direct WebRTC connection, a lookup of or connection to a made-up address through a link hint, a background page request triggered by a prerender hint, and requests to this site itself, which end up in its hosting provider’s logs. The site’s own code uses none of them. The technical guide lists them all.
• The counter and the storage panel report what happens on this page. A malicious script running on the page could also change what they show, so they check the site’s own code; they are not a guard against code that is already running.
• AI assistants built into some browsers can read the page, including what you type and the results, and send it to their provider. Gemini in Chrome shares the current tab by default when you start a chat, and Copilot in Edge and Firefox’s AI chatbot can read the page when you use them. No website can opt out of this, and none of the checks above can see it. Keep the assistant closed on a tab that shows something private.
• Your browser and operating system have other features of their own that can read, send or keep what is on the page: page translation, extensions, clipboard history, keyboard learning and history sync. This site turns off spell checking and asks the browser not to save what you type in its tools, but no website can switch all of these off. For passwords, keys and tokens, consider a private window. In Chrome’s Incognito, Gemini is not available, Enhanced spell check is off, extensions stay off unless you allowed them, copies are kept out of Windows clipboard history and cloud clipboard, and Android keyboards are asked not to learn what you type.
• If you do not trust JavaScript code running in your browser at all, the only complete answer is to disable JavaScript or to use the site in a temporary browser profile or virtual machine. Without JavaScript every tool on this site stops working, because all the work happens in JavaScript on your device.

Last updated September 28, 2026.