How we test and score apps

Every app starts at 100 points and loses points for each problem we find, so a higher score is safer. Methodology version 1.1, published 2026-10-18. The scoring code follows this page exactly.

This page is written for readers and will appear on the site. The exact numbers live in methodology/1.0.yaml, and the scoring code in schema/scoring.ts follows them exactly.

The same tests for every app

Every app goes through the same list of 39 checks, grouped into five areas. Each check is a plain question, such as "Does it wait for your agreement before sending data about you?", with a written test procedure that we follow every time. The full list, with how we test each one, is published as the lab protocol.

Area	Worth	What it covers
Privacy	35	What data leaves your device, when, and who receives it
Security	25	Whether the app can be turned against you, by its maker or by someone else
Behaviour and device impact	15	What it does to your computer: starting itself, taking over shortcuts, leftovers
Honesty and dark patterns	15	Whether it tells the truth: its privacy policy, its warnings, how easy it is to leave
Publisher transparency	10	Whether a real, reachable company stands behind it

How a score is worked out

Each check gets a result: passes, partly fails, fails, does not apply, or not tested yet.
Each problem has a fixed cost, set in advance in the methodology. Leaking the contents of your files costs more than leaving a shortcut behind after uninstalling.
How sure we are matters. A problem we saw happen, or that is plain in the code, costs its full amount. One that is likely costs three quarters, and one that is possible but untested costs half. Something we could not verify costs nothing; it is listed as an open question.
Context matters. The cost is lower when the behaviour is what the app is for (a sync app uploading the folders you chose), when you are told clearly on screen, and when you can turn it off. The cost is never lower than a quarter of the full amount, and each of these three questions is answered from evidence, not from the publisher's word.
One mistake, counted once. When several problems come from one design decision, the largest counts in full and the others count half.
Problems in the same area add up, with diminishing effect. Each one removes a share of what is left, so the first serious problem costs the most and an area can never drop below zero.
The five areas are added up to give a score out of 100.

From score to verdict

Verdict	Score
Safe	75 to 100
Caution	50 to 74
Shady	under 50

Some problems matter more than any total, so these rules can lower the verdict, and nothing can raise it:

Any high-severity problem rules out Safe, whatever the score.
Any critical problem means Shady, whatever the score. Examples are hidden or injected code, collecting sensitive data it does not need, sending the contents of your files without asking, or fake warnings to sell you something.
Code we could not read cannot be Safe. An app that hides its code from analysis is Caution at best, even when we found nothing wrong.

Our editors may lower a verdict further, for example when a publisher refuses to fix a serious leak. When they do, the report says so and why. They can never raise it.

Reference cases

The methodology is tested against reference cases before any change is accepted: a clean offline tool must score 100; an app that only sends crash reports without asking stays Safe; one that sends analytics before you can agree is Caution; a scareware cleaner, a document uploader that denies it, and a keylogger are Shady. These cases are published with the methodology. If a change to the numbers would move one of them, the change is rejected.

Fair comparisons

Every report says which methodology version scored it. When we change the methodology, we publish the new version and re-score every app, so apps on the site are always compared on the same terms.
Lists such as "safest PDF readers" are ranked by verdict, then score, then the number of serious problems, then how recently the app was tested.
A score is marked provisional until every required check has been run.

What a score is not

A score describes what we observed in one version of an app, tested on the date shown. It is not a guarantee, and later versions may behave differently. Every report links to the evidence so you can check our work.

Every check

Privacy 35 points

Waits for your agreement before sending data about you: How: Reset the test machine, install, launch and leave the first screen untouched for 60 seconds while capturing all traffic. Then answer No to every consent prompt and use the app for 10 minutes.; Partly fails (4 of 35, low): Only crash reports or technical diagnostics are sent without asking.; Fails (12 of 35, high): Usage, analytics or personal data is sent before you can agree, or after you refuse.
Keeps the contents of your files on your device unless you send them: How: Open, create and download test documents with distinctive contents, then search the traffic capture for those contents, previews and extracts.; Partly fails (12 of 35, high): Previews, thumbnails, extracts or metadata from inside your files leave the device without an action of yours that asks for it.; Fails (25 of 35, critical): The contents of your files leave the device without an action of yours that asks for it.
Keeps the names of your files on your device unless you send them: How: Open, create and download test documents with distinctive names, then search the traffic capture for those names and paths.; Partly fails (5 of 35, medium): Details about files leave the device (type, count, size), but not names.; Fails (12 of 35, high): Names or paths of your files leave the device without an action of yours that asks for it.
Asks before uploading anything you made: How: Open every share, sync, cloud and export screen, then cancel. Check the capture for uploads.; Fails (6 of 35, medium): Content is uploaded before you confirm.
Sends data only to companies its features need: How: List every destination in the capture, identify who runs it, and compare with what the feature needs.; Partly fails (3 of 35, low): Data goes only to crash reporting or infrastructure providers.; Fails (7 of 35, medium): Your data reaches analytics, advertising or unidentified companies.
Sends no lasting device or advertising ID to advertisers: How: Search the capture for hardware, install and advertising IDs; reinstall and check whether they repeat.; Fails (7 of 35, medium): A lasting ID reaches an advertising company.
Only touches sensitive data it needs: How: Seed the clipboard, location, contacts and typed text with canary values. Check the code and capture for access to the clipboard, keystrokes, screen, camera, microphone, location and contacts.; Partly fails (5 of 35, medium): It reads sensitive data it does not need, but we did not see it sent.; Fails (35 of 35, critical): It collects and sends sensitive data it does not need.
Does not watch your files or activity in the background: How: Check the code for file, window and activity watchers, and confirm while the app is closed or in the tray.; Partly fails (2 of 35, low): It watches only after you turn the feature on.; Fails (5 of 35, medium): It watches by default.
Keeps no needless record of what you do optional: How: Inspect the app's settings, databases and logs after use.; Partly fails (2 of 35, low): It keeps a history of your files or activity that its features do not need.; Fails (4 of 35, medium): That history is unprotected or shared.

Security 25 points

Encrypts everything it sends: How: Check every connection in the capture for TLS and certificate validation.; Partly fails (3 of 25, low): Only requests carrying no personal data are unencrypted.; Fails (8 of 25, high): Personal data or app code travels unencrypted.
Checks that updates are genuine before installing them: How: Identify the update channel and confirm signature checking, or that updates come only through an app store.; Fails (8 of 25, high): Updates are installed without a signature check.
What it does cannot change without an update you can see: How: Check whether the main interface or privileged logic is loaded from a server at run time.; Partly fails (2 of 25, low): Features, prompts or data collection can be switched on or off from a server without an update, but the code itself does not change.; Fails (4 of 25, medium): The main interface or privileged behaviour comes from a server and can change at any time.
Gives web content only the access it needs optional: How: For apps that show web content, list the functions exposed to it and which pages receive them.; Fails (4 of 25, medium): Web content, or any page that loads, gets access to files, settings or the system.
Refuses permissions it does not need optional: How: For apps that show web content, check for a permission handler and what it allows.; Fails (3 of 25, low): Sensitive permissions are granted to web content without checks.
Opens only safe links and programs: How: Find every place the app opens links, files or programs and check what input it accepts.; Fails (4 of 25, medium): It opens links, protocols or programs chosen by untrusted input without checks.
Its own safety limits cannot be switched off from outside optional: How: For each limit the app sets itself (allowlists, sandboxes), check whether remote or untrusted input can widen it.; Fails (4 of 25, medium): Untrusted input can widen or remove one of its own safety limits.
Exposes no unsafe services on your computer: How: List listening ports while running and check their access rules and tokens.; Fails (3 of 25, low): A local service accepts requests from other programs or websites without proper protection.
Ships no parts with known security flaws: How: Inventory bundled runtimes and libraries with versions and match them against public vulnerability databases.; Partly fails (2 of 25, low): Outdated parts with known flaws, but not reachable through the app.; Fails (5 of 25, medium): Known flaws reachable through the app's normal use.
Runs with ordinary user rights: How: Check requested rights, installed services, drivers and scheduled tasks running as SYSTEM or admin.; Fails (6 of 25, medium): It uses admin or system rights, services or drivers it does not need.
Hides nothing in its code: How: Compare runtimes with official releases, check for packing and obfuscation, injection into other programs, anti-analysis tricks and download-and-run behaviour.; Partly fails (6 of 25, medium): Obfuscation or packing we could not see through, with no hidden behaviour found. We cannot call Safe what we could not read.; Fails (25 of 25, critical): Injected, disguised or downloaded-and-run code, or tricks to avoid analysis.
Handles files from other people safely optional: How: Find every place the app opens, extracts or saves content that came from a file (attachments, archives, imports, links inside documents) and check what names, paths and types it accepts. Confirm with a crafted test file where the code suggests a problem.; Partly fails (2 of 25, low): A crafted file can make it write outside the folder you chose, or crash it.; Fails (5 of 25, medium): A crafted file can make it run a program or write anywhere on your computer.

Behaviour and device impact 15 points

Starts with your computer only if you ask: How: Check every startup mechanism (Run keys, startup tasks, services, scheduled tasks, login items) after install and first run.; Partly fails (2 of 15, low): It asks during installation, but the choice is pre-selected or easy to miss.; Fails (4 of 15, medium): It starts at login by default without asking, or turns itself back on after you turned it off.
Stops when you close it: How: Close every window and check for remaining processes.; Fails (2 of 15, low): It keeps running after you close it, without making that clear.
Leaves other programs and system settings alone: How: Check for global shortcuts, default-app changes, browser changes, hosts-file edits and blocked functions in other programs.; Fails (5 of 15, medium): It takes over or breaks functions of other programs or the system.
Stays quiet when you are not using it optional: How: Measure CPU, memory and network over 30 minutes idle and with the window closed.; Fails (2 of 15, low): Noticeable CPU, memory or network use while idle or closed.
Uninstalls cleanly: How: Snapshot files, tasks and registry before install and after uninstall, and compare.; Partly fails (1 of 15, low): Small leftovers such as settings files or shortcuts.; Fails (2 of 15, low): Running tasks, services or large folders are left behind.
Shows nothing outside its own window unless you ask: How: Use the computer normally for 30 minutes with the app installed and note any pop-up, notification or ad.; Fails (3 of 15, low): Pop-ups, ads or notifications appear outside the app or on top of other windows unprompted.
Installs nothing else: How: Compare installed programs, extensions and browser settings before and after installing.; Fails (10 of 15, high): It installs other software, toolbars or extensions, or changes browser settings, without clear consent.
Does not lose or overwrite your files optional: How: Run every action that writes a file (save, split, extract, convert, merge) on test documents whose names and contents you can check afterwards. Read the code behind each one for deletes and overwrites.; Partly fails (1 of 15, low): An action overwrites an existing file without warning.; Fails (3 of 15, medium): A normal action can delete or destroy your files without warning.

Honesty and dark patterns 15 points

Its privacy policy matches what it does: How: Archive the privacy policy on the test date and compare each claim with the evidence.; Partly fails (3 of 15, medium): Claims are vague or only partly true.; Fails (6 of 15, high): A clear promise is contradicted by what we saw.
Leaving is as easy as joining optional: How: For paid plans and trials, count the screens to start and to cancel, and record any pressure or false warnings.; Fails (5 of 15, medium): Cancelling takes clearly more effort than joining, or uses false warnings.
Uses no fake warnings to sell: How: Run the app on a freshly reset machine and check every warning, scan result and error it shows against reality.; Fails (15 of 15, critical): It shows fake errors, fake scan results or false warnings to push a purchase.
Asks everyone for a rating, or no one optional: How: Find the code or settings that decide when a store-rating or review request appears, and what makes it appear or not. Trigger it on a fresh profile and after a refused purchase.; Partly fails (2 of 15, low): It asks for a public rating only after a good moment it picked, but everyone is asked eventually.; Fails (4 of 15, medium): It asks only users it judges happy for a public rating and sends the others to private feedback.
Tells you what it does in the background: How: Compare startup, monitoring and data sending with what the store listing, installer and app screens say.; Fails (4 of 15, medium): Startup, monitoring or data sending is not disclosed anywhere you would see it.
Is what it says it is: How: Check names, icons, publisher details and system entries for borrowed or misleading identities.; Partly fails (2 of 15, low): Misleading names in system entries, without impersonating anyone to the user.; Fails (6 of 15, high): It impersonates another product or company.

Publisher transparency 10 points

Comes from a real company you can reach: How: Check company registers, the store listing, the website and a published contact address.; Fails (5 of 10, medium): The publisher cannot be identified or contacted.
Has a complete privacy policy: How: Find and archive the privacy policy, and check it names the data collected and who receives it.; Partly fails (2 of 10, low): The policy exists but leaves out data or recipients.; Fails (4 of 10, medium): There is no policy, or it cannot be reached.
Has a clean track record optional: How: Search regulator databases, breach records and the publisher's other apps.; Partly fails (2 of 10, low): Minor past issues, since resolved.; Fails (4 of 10, medium): Breaches, fines or harmful apps under the same owner.