Check it yourself.

The website tools

1. Open Safe Paste, or any other tool, in Chrome, Edge or Firefox.
2. Open the developer tools with F12, or Ctrl+Shift+I (Cmd+Option+I on a Mac), and choose the Network tab. Tick Preserve log (Chrome and Edge) or Persist Logs (Firefox).
3. Paste something private and use the tool as you normally would.
4. Read the list. You will see the page’s own files from thinkhard.si, and one small request to /api/hit.php when you first use the tool. Click it and open Payload (Chrome and Edge) or Request (Firefox): it holds the page’s address and one event name, such as {"path":"/safe-paste/","event":"tool_run"}, and nothing you typed. With Global Privacy Control or Do Not Track turned on in your browser, not even that is sent.

On Safe Paste, the line under the text box shows the same list as you type, read from the same record the Network tab uses.

A few tools do read text on our server, and each says so beside its button: Deep check and the engine’s tools, such as Instruction Check. They send your text only when you press that button, and the Network tab shows that request too. Where your text goes, tool by tool.

The browser extension

What it is allowed to do

Its permissions are storage, for its on and off switch, and contextMenus, for the right-click item. It runs only on chatgpt.com, chat.openai.com, claude.ai, gemini.google.com, copilot.microsoft.com and copilot.com, and asks for no access to any other website. See this in Chrome or Edge on the extensions page, under Details, and in Firefox at about:addons, under Permissions.

Watch it work

Open the Network tab on a chat site such as chatgpt.com. Most requests there are the chat app’s own. Anything the extension fetched would show chrome-extension:// (or moz-extension:// in Firefox) in its address or in the Initiator column. At most you will see it load its own files from inside the extension, such as lib/grade.js and lib/search-prompts.json; you will see nothing it sends to any website.

To check its background part in Chrome or Edge, turn on Developer mode on the extensions page and choose Inspect views: service worker under the extension: its Network tab stays empty. In Firefox, the same is at about:debugging#/runtime/this-firefox, under Inspect.

Read its code

The code is not minified, and it is on your computer. Chrome keeps it in your profile folder, in a folder named after the extension’s id, ogohljaiknpnpfieeighcfoeaknhhbjo, then its version:

• Mac: ~/Library/Application Support/Google/Chrome/Default/Extensions/ogohljaiknpnpfieeighcfoeaknhhbjo/
• Windows: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\ogohljaiknpnpfieeighcfoeaknhhbjo\
• Edge, with the extension added from the Chrome Web Store: the same path under its own Microsoft Edge folder.
• Firefox: a file named prompt-score@thinkhard.si.xpi in your profile’s extensions folder (about:support opens the profile folder). It is a zip file.

If you use more than one browser profile, Default may be Profile 1 or similar. The code that reads the message box is content.js; Safe Paste’s rules are in lib/redact.js.

The Office add-ins

The add-in pane in Word, Excel, PowerPoint and Outlook is a page from thinkhard.si, which Office shows in a frame. In Office on the web, open the browser’s developer tools as above: you will see the pane’s own files and one anonymous page count, and nothing you type or the add-in reads. In the desktop apps, Microsoft’s documentation for add-in developers explains how to open the same tools for a pane.

File fingerprints

A fingerprint (a SHA-256 hash) changes completely if a single character of a file changes. Work out the fingerprint of a file in your installed copy and compare it with the list below.

• Mac or Linux, in Terminal: shasum -a 256 content.js
• Windows, in PowerShell: Get-FileHash content.js

The stores add files of their own: Chrome and Edge add a _metadata folder and an update address in manifest.json, and Firefox adds a META-INF folder with Mozilla’s signature. Compare every other file; the manifest.json fingerprints below are for the packages as we built them.

Version 1.5.0, built November 8, 2026. The Chrome Web Store, Edge Add-ons and Firefox Add-ons packages hold the same files, except manifest.json, which carries each store’s name and settings.

The packages as built for each store: Chrome Web Store d1ee22d77348a4459417b22f2f61501f97e2822f77a4d716516bfe2d50a16e8b; Edge Add-ons aa855c3b39ee9209743150747a9c73217fbbc88a7b22bd9c7697ae8744248987; Firefox Add-ons 5c3ddacfc321c8efb6d87282ab1be71b12c281a947b4b616b227e7d4e36c32e2. All of it as JSON.

What is not proven yet

• No independent audit or penetration test yet. When there is one, its full report will be on the trust page.
• The extension’s code can be read on your computer, but it is not yet published in a public repository that rebuilds the same files.
• Safe Paste’s accuracy has not been measured yet; what we measure says how it will be.
• Fingerprints start with version 1.5.0. Earlier versions were not recorded.

Found something?

If your check shows something this page does not explain, tell us: contact@thinkhard.si. Security problems are covered by our disclosure policy.