Ten things somebody was about to paste into a chatbot, drawn fresh from a pool of 32. One question each time. Several of them are perfectly fine, and those are the ones people get wrong.
Guessed from your browser’s locale — never from your IP. Nothing is looked up. Changing it deals a fresh ten.
Your score
0/ 10
Nothing was recorded. The score exists in this tab and nowhere else — close it and it is gone.
Now do it with something real: check a paste and see what is actually in it, in your browser, before an AI tool gets a look.
Ten scenarios each time, dealt from a pool of 32 drawn from the arguments on the five answer pages on this site. A stack trace with a live key in it. A customer export. A watermark that means nothing. Each one asks a single question — would you paste this into ChatGPT, Claude, Copilot or anything like them — and tells you straight away whether that was right, and why.
It takes about three minutes. There is no sign-up, no email, no score stored anywhere. The whole thing runs inside this page, which is the same claim the checker makes and can be verified the same way: open devtools, watch the network tab, answer a question. Nothing goes out.
Because the useful rule was never "never paste". Every draw contains three scenarios that look alarming and are completely fine, plus a couple more that are simply unremarkable — so someone who answers "wouldn't paste" to all ten scores about six, and that is the entire point of the exercise.
A test made only of obvious disasters teaches the reflex to refuse, and a reflex to refuse is what people quietly stop obeying the first time it gets in the way of their actual job. The published sample key, the sandbox test card and the "confidential" stamp on a deck that is already on your own website are all things that look alarming and cost nothing to share. Knowing which is which is the skill. Refusing everything is not.
If you want the short version to send to somebody: the question is never how frightening the text looks. It is what the text actually is, and who it belongs to.
A few scenarios — a tax number in a payroll message, a health identifier, bank details, a customer's contact row — show the format used where you are. An Australian visitor sees a tax file number, an American sees a Social Security number, a British visitor sees a National Insurance number. Every one of those values is synthetic: they are the published reference numbers from this site's own pattern corpus, which is to say they are the examples the standards bodies print in their own documentation. Nobody's number is in here.
Your region is guessed from your browser's time zone and language, exactly as the checker does it, and never from your IP address — an IP lookup would be a network request on a page whose whole claim is that there isn't one. The selector above the test changes it, and deals a fresh ten.
Every question links the page it was drawn from. If you would rather read than be tested: