Correction, October 7, 2026: We removed an unsupported extension-theft figure and unrelated citations, corrected descriptions of TDA tools, and replaced absolute claims about messaging, browser fingerprinting and AI scraping. The original publication date is unchanged.
A useful privacy check ends with a change you can explain. Choose something specific: who can sign in to an account, which extensions can read a page, or what a photograph reveals. You do not need to replace every service today.
The EFF security-plan guide is a good starting point when the consequences are unclear. Write down what matters, who might access it, and what inconvenience you can reasonably manage.
1. Secure the accounts you depend on
Start with your main email and password-manager account. Check their recovery methods before changing sign-in settings. Replace reused passwords with unique ones, enable an available multifactor method, and store recovery codes somewhere you can reach if your usual device is lost.
CISA’s basic guidance covers unique passwords, multifactor authentication, software updates and recognizing phishing. Keep devices and applications updated too. A new password does not remove malicious software already running on a device.
Use the service’s own settings to review active sessions and remove ones you do not recognize. Our password guide and tool comparison explain the next choices.
2. Review browser access
Open your browser’s extension manager. For each installed extension, check its publisher, purpose and requested permissions. Remove ones you do not use. If a permission seems unrelated to the feature, read the developer’s explanation before allowing it. Broad access alone is not proof of malware.
Mozilla’s extension guidance explains why store checks cannot guarantee safety. Revisit permissions after an extension changes ownership or adds a feature you did not expect.
Before you add that extension: check who publishes it, read requested permissions, match access to the job, and remove what you no longer use.
TDA checklist, created with AI assistance. Save the share card.
Review camera, microphone, location and notification access in the browser’s site settings. TDA’s Permission Audit only shows supported permissions for this site; it cannot inspect every site or extension. Our Fingerprint Analyzer displays browser signals, not a population-based uniqueness score.
3. Check a file before you share it
Keep an original and work on a copy. For a photograph, inspect supported metadata with EXIF Viewer, export with Metadata Wiper, then reopen the output and inspect it. These tools process the file in your browser.
Look for details in the image itself: names on badges, open tabs, addresses, reflections and screens. A metadata tool cannot remove those. Check the actual download, rather than assuming the on-screen preview matches what you will send.
For text, Text Sanitizer can help find supported personal data patterns. Read the result for names and context it missed. Do not treat invisible characters as protection against copying or automated collection.
4. Separate private messages from public posts
Signal’s policy describes end-to-end encrypted messages and calls, alongside technical information retained to operate the service. That is not a promise of zero metadata. Review linked devices and notification previews. A recipient can still copy a message or photograph a screen.
Before posting publicly, check the audience, the account you are using and the content of attached files. URL Cleaner can remove recognized tracking parameters from a link, but it cannot make the destination trustworthy.
5. Understand what a network check can tell you
A VPN changes part of the network path and who you trust with it. It does not erase account logins, browser cookies or information you enter into a website. The EFF VPN guide explains these limits without treating every public Wi-Fi connection as a crisis.
Read a tool’s data label first. An IP lookup must contact an external service to observe a public-facing address. A failed lookup means the result is unavailable, not that a leak or threat has been ruled out.
Keep a short record of the changes
Write down what you changed and when to check it again. Test account recovery, review the exported file, and undo a setting if it breaks something you need without giving you a useful benefit. The resource hub groups the guides and tools so you can return to one task at a time.