Does a Headcanon Generator Upload Your Character Name? Test It in Two Minutes
Short answer: do not take a generator's word for it — run the two-minute test. Open the tool, open your browser's developer tools, switch the Network panel to Offline, then generate again. A generator that keeps its lines inside the page will keep working with the network switched off and log no new requests; a generator that calls a server will stall, error, or return nothing the moment the connection dies. Then search the page source for fetch, XMLHttpRequest and sendBeacon: a fully local tool contains none of them. Our own generator is one file of 42,054 bytes — a single inline script, zero network calls, zero storage, one name field capped at 60 characters, and 180 prewritten lines shipped inside the page. Every one of those numbers is counted, not claimed, and you can re-count all of them yourself.
Headcanon is often the most private thing a writer makes. It runs ahead of canon, so it spoils stories that have not been published yet. It names original characters who exist nowhere else. It carries a campaign that your group has not played. So when a generator asks for a character name, the interesting question is not whether the tool is trustworthy in the abstract — it is whether the sentence you just typed travelled anywhere. That question has a checkable answer, and it takes less time to check than to read a privacy policy.
A generator is either a page or a phone call
Almost every generator you will meet is one of two machines, and they look identical on screen.
The first is a self-contained page. It is HTML, styles, a block of prewritten lines and a short script that shuffles them and fills in a name. Everything it needs arrives in that first download, so after the page has loaded the tab can work with the cable unplugged.
The second is a thin client. The page is mostly a form. Clicking the button packages whatever you typed and posts it to a machine the operator runs, which produces lines and sends them back. The output can be better, because the machine behind it can be large — but the sentence you typed has left your computer by definition, and from that point its fate is governed by somebody else's logging, retention and account policy.
You can often guess which one you are looking at from the business model. If a generator needs an account, a credit balance, or a monthly subscription to keep going, then something is executing on a machine that is not yours. But guessing is not checking, and the check is short.
The test, in four steps
You need a browser and about two minutes. Nothing here requires an extension or a tool you have to install.
- 1. Watch the load. Open the generator. Press F12 (or Ctrl+Shift+I) to open developer tools and go to the Network panel. Tick Disable cache, then reload with Ctrl+Shift+R. Count the rows that appear. A local tool loads the document itself and then stops, because its styles, its data and its script are all inside that document.
- 2. Generate something distinctive. Type a name you would notice if it appeared anywhere else — a two-word phrase, not Test. Click generate, then look back at the Network panel. If the row count has not changed, nothing was transmitted when you clicked. If a new row appears every time you click, your input is leaving, and the first part of that row is the address it is going to.
- 3. Cut the connection and click again. In the same panel, change the throttling dropdown from No throttling to Offline. Click generate once more. A local tool does not care: the lines were already on your machine. A server-backed tool now has nothing to talk to, and you will see it fail, hang, or hand you an error message.
- 4. Read the source. Press Ctrl+U to open the page source and search it for fetch(, XMLHttpRequest and sendBeacon. A page that has no way to transmit cannot have transmitted anything. This step is weaker than the first three, because minified code can hide those calls behind other names, but it is fast and it catches most of what you would want to catch.
How to read what you saw
| What the Network panel shows | What it means |
|---|---|
| The document loads; clicking generate adds no rows | The lines were already in your tab. Nothing you typed was transmitted. |
| A new row appears on every click | Your input is being sent. The start of that row is the destination. |
| Generating still works in Offline mode | Nothing was required from a server, so nothing could have been sent. |
| Generating fails in Offline mode | The tool cannot produce anything on its own. Your input goes to whoever runs that server. |
| A data row appears when the page loads, before you type | Something is checking in on arrival. That may be analytics rather than your text, but the page is talking to a third party either way. |
Four ways to fool yourself
- A cached page makes the panel look clean. If the tool was already in your browser cache, a reload can produce almost no rows and you will conclude there is no traffic. Tick Disable cache and force a hard reload before you count.
- A filtered panel hides the evidence. If the panel is filtered to one request type, you only see that type, and a payload sent as an image or a beacon may not match the filter. Leave the filter on All.
- You tested the demo, not the tool. Some generators show a sample set for free and put the real thing behind a sign-up. The demo may be local while the paid version is not. Run the test on the thing you would actually use.
- You only tested the load. A page can be silent until the moment you click. The click is the part of the test that matters, because that is when your text exists.
What our own tool measures on this test
Since the test is easy to run on us, here is the result rather than an assurance. Each figure below was counted out of the page file itself on 22 September 2026, and the live copy served by the host matched the file on disk byte for byte when the count was taken.
| What we counted | Result |
|---|---|
| Files the generator needs to run | 1 |
| Size of that file | 42,054 bytes |
| Inline script blocks, and their share of the file | 1 block, 29,119 bytes (about 69%) |
| External scripts, stylesheets, fonts or images loaded by the page | 0 |
| Network calls written anywhere in the script — fetch, XMLHttpRequest, WebSocket, EventSource, sendBeacon, Worker, dynamic import | 0 |
| Uses of localStorage, sessionStorage, document.cookie or IndexedDB | 0 |
| Times the page reads values out of the address bar | 0 |
| Text fields the tool asks you to fill in | 1, capped at 60 characters |
| Headcanon lines shipped inside the file | 180 |
| Requests the generator makes after the page has loaded | 0 |
Two of those rows are the reason the offline step of the test passes here. The page asks you for one short string and nothing else — no fandom, no context box, no tone questionnaire that a server would need in order to answer. And the whole data bank plus the drawing code sits inside the same script, occupying the last 28,752 characters of the file, so there is nothing left for the browser to fetch when you click.
The sentence you can find in the source
There is a faster proof than any of the above, and it takes one search. Open the page source and search for the words writes lists, loses the lists, and trusts the lists anyway. You will find it sitting in the file in plain text, written as a template that starts with a {name} placeholder. That placeholder is swapped for whatever you typed by a local string function, in your own tab. The line was already on your machine before you clicked anything — which is precisely why there is nothing for a network request to do.
You can run the same search on any generator. If the sentences it produces are not in the file, they are being manufactured somewhere else.
What this test cannot tell you
- It does not prove the page will stay this way. It is a measurement of a moment. A page can be edited tomorrow, so the test is worth re-running after any update — it costs two minutes.
- It does not make loading a page private. Opening any URL is itself a request, and the site's host — and its content network — sees the standard technical details that come with it, such as your IP address, your browser's user agent and which address you asked for. What you typed is a separate question from who knows you visited, and this test only answers the first one.
- It does not vouch for the author. It establishes a property of the artefact: this tool does not need a server, and this version of it does not talk to one. That is a narrower claim than trust, and it is the one you can actually verify.
The trade-off, said plainly
A local tool buys privacy with a fixed bank. Because the lines are prewritten rather than produced on demand, they are finite, and they will eventually come back around — a property shared by every generator that draws from a list, whether or not it admits it. We published the exact counts and the repeat arithmetic on a separate page, because a limit you can measure is more useful than a promise you cannot.
The generator itself is on the front page of this site, and the full statement of what the site does with data lives in the privacy policy. Both are shorter than you expect, for the same reason: there is less to describe when nothing you type goes anywhere.