Research · 2026-09-05
What free invoice generators do with what you type
An invoice carries a customer's name, their address and what they were charged. We measured 44 free invoice generators to find out where that text goes when you type it: whether it leaves the browser, who receives it, and how much of the page belongs to companies other than the tool.
Every figure below is an observation, not a rating. There is no score, because a score is only someone's weighting argued in public. The method is published, the raw data is downloadable, and anyone can re-run it.
Invoice Workshop is measured on exactly the same terms as everything else and appears in the table, but it is excluded from every figure quoted on this page. It did not rank in the top 20 for any of the 18 queries used to draw the sample — it is in the table only because we put it there, and that is worth knowing before you read further.
What we found
Most of them keep it in the browser. Of the 33 tools where the test ran to completion, 25 never sent what we typed anywhere. That is the opposite of what we expected before running it, and it is the most useful thing on this page.
8 sent it to a server. For 6 of those the recipient was the tool's own service, which is how a server-rendered PDF has to work and is not a criticism of anything. 2 sent something to a company that was not the tool: intercom.io and unifyintent.com. In both cases it was one field, not the invoice, and the table names which one — because the difference between an email address in a marketing form and a customer's address on an invoice line is the whole distinction, and a study that blurs it is worthless.
Precisely: on invoicesimple.com the field labelled Business Number appeared in a request to api-iam.intercom.io, a third-party customer-messaging service. The rest of that invoice — business name, client name, street, item description, notes, both email addresses — went to data.getinvoicesimple.com, which is a different registered domain but carries the tool's own name. On xero.com's invoice template page, an email address typed into the form on the page reached api.unifyintent.com, a business visitor-identification service. No invoice content was involved in that one. Both of these were re-run in a second session with a different canary string and both reproduced, because a named finding about a named company should not rest on one page load.
The exposure is the advertising, not the invoice. Half the tools loaded code from 11 or more other companies' domains while an invoice was being filled in. The highest loaded 162, on invoice-generator.com — which was the first result for "free invoice generator" when the sample was drawn. None of those companies received the invoice. All of them were told you were on a page about invoicing, which is what an ad auction is for.
Almost nobody makes the promise. Only 4 of 44 say anywhere on their site that your data stays in your browser. Of those, 0 broke the claim. The claim is rare, not unreliable.
11 of the 44 pages that rank are not generators. They are template galleries and landing pages: there is no invoice to fill in on the page you arrive at. They are listed as not measured rather than assumed either way, and they are worth knowing about before you click.
How the sample was drawn
The one place a comparison is normally rigged is deciding who is in it. Nobody decided here. On 2026-09-05 we ran 18 search queries — the phrases people actually type, fixed in advance — took the top 20 results for each, removed app stores, forums and articles about tools, and kept one page per domain. That gave 44 tools. No tool was added or dropped after the measurements were seen.
Method
Each tool was opened in a fresh browser with no history, no extensions and no stored data. Every network request the page made was recorded. A canary string was then typed into every text field on the page, the way a person filling in an invoice would — a different token in each field, built on the base AUDITCANARY7Q3X, so a value found leaving the page can be traced back to the box it came from. The main action was then triggered: download, generate, export, in that order of preference.
Afterwards, every request the page had made since the typing started was searched for those tokens, in the URL and in the request body. If one appears, that text left the browser, and the table records which field it was and which domain received it. If it does not appear, it did not leave during the test. That is the whole measurement — there is no judgement in it.
Knowing only that something left would not be enough to say anything fair about a tool: an email address typed into a newsletter box and a customer's address typed onto an invoice line are not the same finding, and the first must never be published as the second.
A destination on a different registered domain is not automatically a different company.invoicesimple.com posts to getinvoicesimple.com; calling that a third party would be a false accusation about a company's own backend. The rule used here is mechanical: if the two names contain each other, they are counted as the same operator. It is a statement about the names, not about who owns what.
Separately, the page's own words were searched for a claim of local processing — phrasings like "never leaves your browser", "processed locally", "client-side". Pairing that with the network result is what makes the claim column meaningful. A tool that makes no such claim and processes your invoice on a server is not failing anything; it is being straightforward.
What this does not show
- It is not a finding or allegation of wrongdoing, a legal breach or misuse of data by any company. It records which network requests one automated test session observed.
- It is one session per tool on one date. A tool that kept your data in the browser then can change tomorrow, and this does not watch it.
- Only the free flow a visitor gets was exercised — fill in the fields, click the main button. Anything behind an account, and anything that happens when you email an invoice from inside the tool, was never triggered and is not measured.
- "Did not leave the browser" means the canary was not found in any request this test saw. It is not an audit of a company, its servers, or how long it keeps anything.
- The PDF column records whether a file actually downloaded during the test. Tools that open a print dialog, render a preview, or email the PDF instead will read "No" here despite giving you a usable invoice. Do not read that column as "no free PDF".
- Third-party domain counts move with ad auctions and consent state. They measure how much of the page is other people's code, not a fixed property of the tool.
- The name-in-PDF column reports whether the tool's own name appears in the PDF's text. A footer credit and a stamped watermark both trip it; it cannot tell them apart.
- The harness fills every visible text field, so on a page that mixes an invoice editor with a newsletter box it will type into both. That is why the table names which field left rather than only that something did.
The data
| Tool | Typed data left the browser | Sent to | Which fields | Claims local processing | PDF file downloaded in the test | Third-party domains | Own name in the PDF |
|---|---|---|---|---|---|---|---|
| adobe.com | Not measured | — | — | No | No | 45 | — |
| app.invoicera.com | No | — | — | No | No | 7 | — |
| app.paydirtapp.com | Yes | paydirtapp.com | user[email] | No | No | 8 | — |
| billdu.com | Not measured | — | — | No | No | 4 | — |
| bloom.io | No | — | — | No | No | 8 | — |
| canva.com | Not measured | — | — | Not measured | No | 10 | — |
| craftmypdf.com | Yes | craftmypdf.com | balance; bill_to; bill_to_address; company_address; company_email; company_name; currency; footer; invoice_date; invoice_due_date; invoice_no; td | No | No | 10 | — |
| create.onlineinvoices.com | No | — | — | No | No | 3 | — |
| docelf.com | No | — | — | No | No | 11 | — |
| everhour.com | No | — | — | No | No | 7 | — |
| famewall.io | No | — | — | Yes | No | 15 | — |
| flowlu.com | No | — | — | No | No | 12 | — |
| freeinvoicebuilder.com | Not measured | — | — | No | No | 0 | — |
| getharvest.com | No | — | — | No | No | 17 | — |
| getjobber.com | No | — | — | No | No | 41 | — |
| helcim.com | No | — | — | No | No | 28 | — |
| invoice-generator.com | No | — | — | No | Yes | 162 | No |
| invoicefree.in | No | — | — | No | No | 7 | — |
| invoicegenerator.com.au | No | — | — | No | No | 18 | — |
| invoicehome.com | Yes | invoicehome.com | invoice[billing]; invoice[date_issued_string]; invoice[from]; invoice[items_attributes][0][amount]; invoice[items_attributes][0][description]; invoice[number] | No | No | 8 | — |
| invoicemaker.com | No | — | — | No | No | 17 | — |
| invoicequick.com | Not measured | — | — | No | No | 21 | — |
| invoicesimple.com | Yes | getinvoicesimple.com; intercom.io | (123) 456 789; 123-45-6789; Additional details; Business Name; Client Name; Item Description; Notes - any relevant information not covered, additional terms and conditions; Street; client-email; company-email; invoice-title | No | No | 54 | — |
| justdial.com | No | — | — | Not measured | No | 10 | — |
| mazu.in | Not measured | — | — | No | No | 7 | — |
| pinebill.app | No | — | — | Yes | Yes | 11 | Yes |
| plaininvoice.com | Yes | plaininvoice.com | Client Name; Comments; Footer Text; Name; text | No | No | 10 | — |
| portal.billgenerator.in | Yes | billgenerator.in | Enter customer signature URL (e.g., https://example.com/image.png); Enter logo URL (e.g., https://example.com/image.png); Enter receptionist signature URL (e.g., https://example.com/image.png) | No | No | 14 | — |
| portant.co | No | — | — | Yes | No | 29 | — |
| poundkit.co.uk | Not measured | — | — | Yes | No | 0 | — |
| quickbooks.intuit.com | No | — | — | No | Yes | 55 | No |
| refrens.com | Not measured | — | — | No | No | 10 | — |
| rtcsuite.com | No | — | — | No | No | 8 | — |
| sbent.tech | No | — | — | No | No | 6 | — |
| simple-invoice-generator.com | No | — | — | Yes | No | 8 | — |
| skynova.com | Not measured | — | — | Not measured | No | 0 | — |
| smoothledger.com | Not measured | — | — | Not measured | No | 0 | — |
| squareup.com | Not measured | — | — | No | No | 23 | — |
| tallysolutions.com | No | — | — | No | No | 12 | — |
| waveapps.com | No | — | — | No | No | 33 | — |
| wise.com | No | — | — | Not measured | Yes | 22 | No |
| xero.com | Yes | unifyintent.com | Email__c | No | No | 49 | — |
| xolo.io | Yes | xolo.io | items[0].discountPercentage; items[0].price; items[0].quantity; roundingAmount; tax | No | No | 3 | — |
| zoho.com | No | — | — | No | No | 14 | — |
| invoiceworkshop.com — this site | No | — | — | Yes | No | 3 | — |
Blank cells mean the measurement was not made, not that the answer was no. The full dataset carries the measured URL, timestamp, the exact claim quoted from each page, the button that was clicked and any notes.
Press summary
Everything a write-up needs, in one place. All of it is free to quote and reuse under CC BY 4.0 — no permission needed, no embargo, no exclusivity.
The figures, exactly as the dataset has them:
- 44 tools sampled from 18 fixed search queries on 2026-09-05; 33 could be measured, 11 could not.
- 25 of 33 never sent what was typed anywhere.
- 8 sent it to a server — 6 only to the tool's own service, 2 to an unrelated company (intercom.io and unifyintent.com). Both of those were re-run in a second session with a different marker and both reproduced.
- Half the tools contacted 11 or more third-party domains while an invoice was being filled in (median 10.5); the highest contacted 162.
- 4 of 44 claim anywhere on their site that data stays in the browser. 0 of those broke the claim.
- 11 of the 44 pages have no invoice editor on the page you land on.
Please don't write "invoice generators are leaking your data". That is not what this found. Most of them keep it in the browser; the exposure we measured is advertising code on the page, and the two outside recipients each received a single field. The distinction is in the dataset and we would rather it survived into print.
Chart above is free to republish at any size, credited to Invoice Workshop with a link to this page: PNG · SVG. Questions, or a figure you want re-run before you publish: contact.
Take the data
Download the full dataset (CSV)
Published under CC BY 4.0. Use it, quote it, re-run it, correct it.
The same CSV and a full method file are archived on Zenodo with a DOI, so the version you cite stays fetchable whatever happens to this page: 10.5281/zenodo.22648039. The concept DOI 10.5281/zenodo.22648038 always resolves to the newest version.
How to cite this
Invoice Workshop (2026). Free invoice generator audit 2026 (Version 1.0.0) [Data set]. Invoice Workshop.https://doi.org/10.5281/zenodo.22648039https://invoiceworkshop.com/research/free-invoice-generator-audit-2026/
Found a mistake?
If your tool is in the table and the measurement is wrong, tell us what to re-run and we will re-run it and change the row. Write to contact. Corrections are the point of publishing the method.