A practical checklist for credential-less web tools

A calculator, converter, or companion page can look harmless and still send data off the device. If you build or review tools that sit next to a live-service game, the useful test is not whether the UI has a login button. It is what the page collects, where it computes, and which hosts it talks to after someone types a value and clicks a button.

The steps below are a checklist you can run in a browser. They are general advice, not an audit of any one repository. Fortnite Hub, an unofficial fan site, publishes an editorial policy stating that its tools use the inputs shown on each page and do not connect to an Epic account. That is a public policy statement. It is not a substitute for inspecting a particular build.

1. Minimize inputs

Only ask for values the feature needs. A sensitivity converter needs a number and a source or target game, not an email address, not a username, and never a platform password. If a field is not required to produce the result, it should not be in the form.

Treat extra collection as a warning sign, even when it is optional in the UI. File uploads, phone numbers, “sign in with…” buttons, and permission prompts for a camera or contacts are hard to justify on a page that claims to be a local helper. If you are the author, write down the minimum input set first and refuse to ship fields that exist only for marketing or account creation.

2. Local computation is not the same as privacy

JavaScript can multiply two numbers in the page without a server round trip. That can be the right design, and it is still not a privacy guarantee. The same document can also load analytics, advertising, fonts, or partner scripts. Those loads are separate from whether the core math happens in the client.

MDN’s Web Storage API documentation describes how localStorage and sessionStorage are partitioned by origin. Every script running in that origin can read the same store. localStorage persists after the browser is closed; sessionStorage is scoped to the tab and is cleared when the tab goes away. In private or incognito windows, MDN notes that localStorage is treated like sessionStorage and is discarded when the window or tab closes. That is easy to misread as “nothing was ever stored.”

Third-party code included with a script tag runs in the embedder’s browsing context, so storage writes go to the embedder’s origin. Code running inside an iframe uses the iframe’s origin instead. Either way, “it stayed in the browser” does not mean “only the user can see it,” and it does not mean “it never went to a network host.”

3. Verify with the Network panel

The Network panel in browser developer tools is the straightforward way to check what a page actually requests. Chrome’s DevTools Network tutorial is a clear official walkthrough. The important operational detail is this: the panel only records activity while it is open. If you click Calculate first and open DevTools later, you can miss the request.

A practical sequence:

1. Open DevTools (Control+Shift+J, or Command+Option+J on macOS) and select the Network tab.
2. Reload the page so the log includes the initial HTML, scripts, and third-party hosts.
3. Use the tool as a player would: enter a distinctive value, change options, and submit.
4. Right-click the log’s column header and enable Domain, so every host is visible.
5. Click individual requests and read the Headers, Preview, and Response views.
6. Use the Search tab to look for the distinctive value you typed, which shows whether that input left the page.

A static page will still generate traffic: its own documents, scripts, and images. The question is whether later requests — especially fetch, XHR, or form POST calls — carry inputs, identifiers, or credentials to hosts you did not expect.

4. Misconceptions worth discarding

“There is no login form, so it cannot take an account.” Credential theft is one failure mode. Unexpected uploads, hidden fields, and third-party scripts are others.

“It uses HTTPS, so my numbers stay here.” HTTPS protects the transport. It does not choose the destination.

“The Network panel was empty.” If the panel was closed during the click, the log may simply have started too late. Open it first, reload, and repeat the action.

“localStorage is private storage.” It is origin-scoped storage available to script on that origin, not a sealed vault, and it is not encrypted by the API itself.

If you operate a companion site, describe what you collect and what you do not, then expect readers to compare that description with a Network log. Policy text and implementation can drift; the log is the part a reader can check without a repository.

Sources

• Inspect network activity in Chrome DevTools
• MDN: Web Storage API
• MDN: Using the Web Storage API

This article was prepared with AI assistance on behalf of the site operator.