Formspill

Before you type into a form, see who gets it: the site, Google, Meta, session recorders. Uses made-up details; nothing real is sent.

Formspill is a privacy checker and tracker detector for web forms. Before you type your email, phone number or card details, see which trackers get them: ad networks, analytics tools and session recorders. A tracker list only tells you who is on a page. Formspill shows what they actually receive: details sent while you type (key logging), before you press send, emails "hashed" so ad networks can still match them to you, and session recordings of the form. It checks with made-up details, so your real information is never used and nothing is sent. Useful for privacy-conscious shoppers, and for site owners, marketers and developers doing a pixel check or privacy audit of their own forms. Click the Formspill icon on any page and a sidebar shows which companies are present, what information they could access, and what the privacy check detects. For example: • "This site: gets your email and name when you press send" • "Google Ads: gets your email while you type, before you press send" WHAT YOU SEE • What the page asks for: Your email, name, phone number, card details and more, with a "Show me" button that points directly to the form. • Multiple forms: Choose which forms to check and see where each form's details could go. • Third-party trackers: Discover which other companies run code on the page and could potentially access what you type. • Where your data goes: After a check, see which companies would receive your details and when — while typing or on submission. This includes scrambled ("hashed") details that advertising networks may still use to recognize you, and session recorders that capture your visit. • Privacy warnings: Spot forms that transmit data without encryption, expose personal details in website addresses, or have marketing consent boxes already checked. HOW THE CHECK WORKS Click "Check where my data goes" to open the page in a separate private window. Formspill fills forms with obviously made-up details and monitors network requests to detect where that information would be sent. Requests containing the test details are blocked inside the browser to prevent those details from being transmitted. Formspill can also: • Open pop-up forms such as "Sign up" and "Get 10% off." • Follow multi-step forms beyond "Next" buttons. • Detect trackers that collect information while you type, one character at a time, or a few seconds later. • Recognize form fields in English, German, French, Spanish, Italian, Dutch, Swedish, Portuguese, Hindi, Chinese and Japanese. • Identify sensitive fields involving bank details, identity numbers and health information. For forms behind your login, such as checkout, account and member pages, you can switch the check to your normal browser profile in Settings (the gear icon at the top). PRIVATE BY DESIGN Formspill has no server, no account, no analytics and no tracking. Everything happens locally in your browser. Your real personal details are never used for testing, and results are kept only until you close the browser. FOR WEBSITE OWNERS Every result links to a technical report with findings and recommended fixes, helping website owners identify and address potential privacy leaks. DATA SOURCES Company names for tracker domains come from the AdGuard companies database (CC BY-SA 4.0), which incorporates WhoTracks.me data (CC BY 4.0).