Tools and guides · Check before you send
Check your HTML page before anyone else reads it.
Drop the file or paste the code. In a second you see what a reader would find: keys left in, images that will not load, notes in the code, tracking scripts. Each comes with its line and the fix.
- Your page never leaves this browser.
- No account needed to check.
Updated 1 November 2026
Check before you send
No page yet
How it works
- Drop or paste the page. Its code is read here, in your browser.
- Read the findings. Each one gives the line, what a reader would see and how to fix it.
- Make it a tracked link. Readers give their e-mail to open it, and you see which part each one read. Name the people you choose, add a code, and only they get in.
The link
Seed round
Seed deck, Q2
- Problem
- Product
- Traction
- Market sizing
- The ask
Link for Halbrook Capital
The gate
Gatehalbrook.vc only
marc@halbrook.vc
Opened · 09:14
ines@halbrook.vc
Opened · 09:31
The first read
First read · E-mail · 09:14
marc@halbrook.vc just opened Seed deck, Q2.
On the link for Halbrook Capital
Longest on Traction, 4m 12s
What the check looks for
Six things that embarrass a sender once the page is open on someone else’s screen.
- Secret keys
- Keys and tokens from AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid and Hugging Face, Google OAuth secrets, Supabase service and secret keys, private key blocks and passwords written into an address.
- Files that will not load
- Images, stylesheets, scripts, fonts and videos named by a path on your computer (images/chart.png, C:\Users\…, file:///…), and images with no file at all.
- Addresses that work only for you
- localhost, 127.0.0.1 and private network addresses, in links or in the code that fetches data.
- Placeholder text
- Lorem ipsum, TODO, [Insert client name] and {{ template }} tags left in the words on the page.
- Notes in the code
- Comments marked TODO, draft, internal only or do not share, old content kept in a comment, and hidden text with the same words.
- Tracking scripts
- Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity, HubSpot, Segment, Mixpanel, PostHog and others.
The code is read as written and none of it runs, so a key that a script builds while the page is open stays out of sight.
Is my page uploaded when I check it?
No. Your page is checked in your browser, and nothing of it is sent, saved or uploaded.
Why is an API key in an HTML file a problem?
Anyone who opens a web page can read its code, so a key in it can be copied and used on your account. Delete it, then switch the key off where it was made and create a new one.
Does a password on the link hide a key in the page?
No. A password or an e-mail check decides who can open the page, and everyone who opens it can still read its code. Take the key out first.
Why do my images not show when I send an HTML file?
An image named by a path such as images/chart.png is a separate file on your computer, and the reader gets only the HTML. Embed the images in the file, or point to public https:// addresses.
Can a Google Maps or Firebase key stay in a page?
Often, yes: those keys are made to sit in web pages. Keep one only when it is restricted to your own website in the Google Cloud console, so nobody else can use it.
What can the check not see?
It reads the code as written and runs nothing, so it cannot see a key that a script builds while the page runs, and it does not visit outside addresses to see whether they still work.
Is the check free?
Yes, and you need no account to check a page. Making it a tracked link is free for two links, with no credit card.
Related
If the page is a client report, the guide to client reports and proposals shows which parts each client read.