Proof, not claims

Tool Scorecards

The first tools on our list, and whether we have actually tested each one. A score appears here only when a dated test with evidence has been recorded. Until then the tool says Not yet tested, however good or bad our editorial opinion of it is.

0 of 8 tools on this board have a recorded test.

How we score

Three dimensions, each out of 10, weighted equally. The method is on How We Test & Score.

• Privacy — What the tool collects, where it goes, whether collection is minimised, and whether the privacy claims are independently audited or merely stated.
• Accuracy — Does it do what it says, reliably, under real conditions, including documented failure modes.
• Independence — Ownership, funding, lock-in, data-export options, and how easily you can leave without losing your data.

The board

This board starts with eight tools we have written about. It will grow as tests are recorded.

What we check before a score is allowed

VPN

• DNS, IPv6 and WebRTC leak tests on at least two networks
• Kill-switch behaviour when the connection drops
• No-logs claim vs. date and scope of the latest independent audit
• Ownership and jurisdiction
• Does the tool work on a fresh install with default settings

Password manager

• Published, dated independent security audit
• Zero-knowledge design and what metadata the vendor can see
• Export: can you leave with all your data in an open format
• Recovery model and what happens if the vendor disappears
• Data incident history and how it was disclosed

Encrypted storage

• Where encryption happens (client or server) and who holds the keys
• Audit status and open-source status of the client
• Export and exit costs
• Behaviour on a failed sync or lost device

Found a tool we should test, or a result we got wrong? Tell us on the contact page.