Research · 2026-09-05
What free invoice generators do with what you type
An invoice carries a customer's name, their address and what they were charged. We measured 44 free invoice generators to find out where that text goes when you type it: whether it leaves the browser, who receives it, and how much of the page belongs to companies other than the tool.
Every figure below is an observation, not a rating. There is no score, because a score is only someone's weighting argued in public. The method is published, the raw data is downloadable, and anyone can re-run it.
Invoice Workshop is measured on exactly the same terms as everything else and appears in the table, but it is excluded from every figure quoted on this page. It did not rank in the top 20 for any of the 18 queries used to draw the sample — it is in the table only because we put it there, and that is worth knowing before you read further.
What we found
Most of them keep it in the browser. Of the 33 tools where the test ran to completion, 25 never sent what we typed anywhere. That is the opposite of what we expected before running it, and it is the most useful thing on this page.
8 sent it to a server. For 6 of those the recipient was the tool's own service, which is how a server-rendered PDF has to work and is not a criticism of anything. 2 sent something to a company that was not the tool: intercom.io and unifyintent.com. In both cases it was one field, not the invoice, and the table names which one — because the difference between an email address in a marketing form and a customer's address on an invoice line is the whole distinction, and a study that blurs it is worthless.
Precisely: on invoicesimple.com the field labelled Business Number appeared in a request to api-iam.intercom.io, a third-party customer-messaging service. The rest of that invoice — business name, client name, street, item description, notes, both email addresses — went to data.getinvoicesimple.com, which is a different registered domain but carries the tool's own name. On xero.com's invoice template page, an email address typed into the form on the page reached api.unifyintent.com, a business visitor-identification service. No invoice content was involved in that one. Both of these were re-run in a second session with a different canary string and both reproduced, because a named finding about a named company should not rest on one page load.
The exposure is the advertising, not the invoice. The median tool loaded code from 11 other companies' domains while an invoice was being filled in. The highest was 162, on invoice-generator.com — which was the first result for "free invoice generator" when the sample was drawn. None of those companies received the invoice. All of them were told you were on a page about invoicing, which is what an ad auction is for.
Almost nobody makes the promise. Only 4 of 44 say anywhere on their site that your data stays in your browser. Of those, 0 broke the claim. The claim is rare, not unreliable.
11 of the 44 pages that rank are not generators. They are template galleries and landing pages: there is no invoice to fill in on the page you arrive at. They are listed as not measured rather than assumed either way, and they are worth knowing about before you click.
How the sample was drawn
The one place a comparison is normally rigged is deciding who is in it. Nobody decided here. On 2026-09-05 we ran 18 search queries — the phrases people actually type, fixed in advance and published in the data file — took the top 20 results for each, removed app stores, forums and articles about tools, and kept one page per domain. That gave44 tools. No tool was added or dropped after the measurements were seen.
Method
Each tool was opened in a fresh browser with no history, no extensions and no stored data. Every network request the page made was recorded. A unique string —AUDITCANARY7Q3X — was typed into every text field on the page, the way a person filling in an invoice would. The main action was then triggered: download, generate, export, in that order of preference.
Afterwards, every request the page had made since the typing started was searched for that string, in the URL and in the request body. If it appears, the text left the browser, and the table records which domain received it. If it does not appear, it did not leave during the test. That is the whole measurement — there is no judgement in it.
A destination on a different registered domain is not automatically a different company.invoicesimple.com posts to getinvoicesimple.com; calling that a third party would be a false accusation about a company's own backend. The rule used here is mechanical: if the two names contain each other, they are counted as the same operator. It is a statement about the names, not about who owns what.
Separately, the page's own words were searched for a claim of local processing — phrasings like "never leaves your browser", "processed locally", "client-side". Pairing that with the network result is what makes the claim column meaningful. A tool that makes no such claim and processes your invoice on a server is not failing anything; it is being straightforward.
What this does not show
- It is one session per tool on one date. A tool that kept your data in the browser then can change tomorrow, and this does not watch it.
- Only the free flow a visitor gets was exercised — fill in the fields, click the main button. Anything behind an account, and anything that happens when you email an invoice from inside the tool, was never triggered and is not measured.
- "Did not leave the browser" means the canary was not found in any request this test saw. It is not an audit of a company, its servers, or how long it keeps anything.
- The PDF column records whether a file actually downloaded during the test. Tools that open a print dialog, render a preview, or email the PDF instead will read "No" here despite giving you a usable invoice. Do not read that column as "no free PDF".
- Third-party domain counts move with ad auctions and consent state. They measure how much of the page is other people's code, not a fixed property of the tool.
- The name-in-PDF column reports whether the tool's own name appears in the PDF's text. A footer credit and a stamped watermark both trip it; it cannot tell them apart.
- The harness fills every visible text field, so on a page that mixes an invoice editor with a newsletter box it will type into both. That is why the table names which field left rather than only that something did.
The data
| Tool | Typed data left the browser | Sent to | Which fields | Claims local processing | PDF file downloaded in the test | Third-party domains | Own name in the PDF |
|---|---|---|---|---|---|---|---|
| adobe.com | Not measured | — | — | No | No | 45 | — |
| app.invoicera.com | No | — | — | No | No | 7 | — |
| app.paydirtapp.com | Yes | paydirtapp.com | user[email] | No | No | 8 | — |
| billdu.com | Not measured | — | — | No | No | 4 | — |
| bloom.io | No | — | — | No | No | 8 | — |
| canva.com | Not measured | — | — | Not measured | No | 10 | — |
| craftmypdf.com | Yes | craftmypdf.com | balance; bill_to; bill_to_address; company_address; company_email; company_name; currency; footer; invoice_date; invoice_due_date; invoice_no; td | No | No | 10 | — |
| create.onlineinvoices.com | No | — | — | No | No | 3 | — |
| docelf.com | No | — | — | No | No | 11 | — |
| everhour.com | No | — | — | No | No | 7 | — |
| famewall.io | No | — | — | Yes | No | 15 | — |
| flowlu.com | No | — | — | No | No | 12 | — |
| freeinvoicebuilder.com | Not measured | — | — | No | No | 0 | — |
| getharvest.com | No | — | — | No | No | 17 | — |
| getjobber.com | No | — | — | No | No | 41 | — |
| helcim.com | No | — | — | No | No | 28 | — |
| invoice-generator.com | No | — | — | No | Yes | 162 | No |
| invoicefree.in | No | — | — | No | No | 7 | — |
| invoicegenerator.com.au | No | — | — | No | No | 18 | — |
| invoicehome.com | Yes | invoicehome.com | invoice[billing]; invoice[date_issued_string]; invoice[from]; invoice[items_attributes][0][amount]; invoice[items_attributes][0][description]; invoice[number] | No | No | 8 | — |
| invoicemaker.com | No | — | — | No | No | 17 | — |
| invoicequick.com | Not measured | — | — | No | No | 21 | — |
| invoicesimple.com | Yes | getinvoicesimple.com; intercom.io | (123) 456 789; 123-45-6789; Additional details; Business Name; Client Name; Item Description; Notes - any relevant information not covered, additional terms and conditions; Street; client-email; company-email; invoice-title | No | No | 54 | — |
| justdial.com | No | — | — | Not measured | No | 10 | — |
| mazu.in | Not measured | — | — | No | No | 7 | — |
| pinebill.app | No | — | — | Yes | Yes | 11 | Yes |
| plaininvoice.com | Yes | plaininvoice.com | Client Name; Comments; Footer Text; Name; text | No | No | 10 | — |
| portal.billgenerator.in | Yes | billgenerator.in | Enter customer signature URL (e.g., https://example.com/image.png); Enter logo URL (e.g., https://example.com/image.png); Enter receptionist signature URL (e.g., https://example.com/image.png) | No | No | 14 | — |
| portant.co | No | — | — | Yes | No | 29 | — |
| poundkit.co.uk | Not measured | — | — | Yes | No | 0 | — |
| quickbooks.intuit.com | No | — | — | No | Yes | 55 | No |
| refrens.com | Not measured | — | — | No | No | 10 | — |
| rtcsuite.com | No | — | — | No | No | 8 | — |
| sbent.tech | No | — | — | No | No | 6 | — |
| simple-invoice-generator.com | No | — | — | Yes | No | 8 | — |
| skynova.com | Not measured | — | — | Not measured | No | 0 | — |
| smoothledger.com | Not measured | — | — | Not measured | No | 0 | — |
| squareup.com | Not measured | — | — | No | No | 23 | — |
| tallysolutions.com | No | — | — | No | No | 12 | — |
| waveapps.com | No | — | — | No | No | 33 | — |
| wise.com | No | — | — | Not measured | Yes | 22 | No |
| xero.com | Yes | unifyintent.com | Email__c | No | No | 49 | — |
| xolo.io | Yes | xolo.io | items[0].discountPercentage; items[0].price; items[0].quantity; roundingAmount; tax | No | No | 3 | — |
| zoho.com | No | — | — | No | No | 14 | — |
| invoiceworkshop.com — this site | No | — | — | Yes | No | 3 | — |
Blank cells mean the measurement was not made, not that the answer was no. The full dataset carries the measured URL, timestamp, the exact claim quoted from each page, the button that was clicked and any notes.
Take the data
Download the full dataset (CSV)
Published under CC BY 4.0. Use it, quote it, re-run it, correct it.
How to cite this
Invoice Workshop, Free invoice generator audit 2026, 2026-09-05.https://invoiceworkshop.com/research/free-invoice-generator-audit-2026/
Found a mistake?
If your tool is in the table and the measurement is wrong, tell us what to re-run and we will re-run it and change the row. Write to contact. Corrections are the point of publishing the method.