Most people treat the Submit button as a boundary.
Before the click, the form feels unfinished.
After the click, the information has been sent.
Technically, a webpage does not have to respect that mental model.
JavaScript running on the page can react while the user types.
That can be useful. A form may validate an email address, calculate shipping, save progress, or warn that a password is too short.
It also means data can potentially leave the page before the user submits the form.
Researchers measured this in the wild
A 2022 USENIX Security study called Leaky Forms examined the top 100,000 websites and looked for email and password data transmitted before form submission.
The researchers found email addresses being sent to tracking, marketing, and analytics domains before submission on 1,844 websites in their EU crawl and 2,950 websites in their U.S. crawl. They also reported incidental password collection on 52 sites associated with third-party session-replay scripts. See Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission.
Those numbers describe that study’s 2022 measurement and methodology.
They should not be casually converted into a claim about every website today.
The important finding is that the behavior is technically real and measurable.
The interface can imply a boundary the code does not use
Imagine entering an email address into a newsletter box.
You pause.
You decide not to subscribe.
You close the tab without pressing anything.
From your perspective, the transaction never happened.
If a script already transmitted the email address when the field lost focus, the site’s data history may disagree.
That is a sharp example of the difference between user intent and event-driven software.
The browser does not inherently reserve typed text until submission. Page scripts may be able to observe input events as they occur.
Not every pre-submit interaction is abusive
A site can process input early for legitimate reasons: fraud detection, validation, autosave, accessibility, or recovering an interrupted form.
So seeing JavaScript react to a field is not enough to prove covert tracking.
A stronger investigation asks whether the value actually leaves the browser, where it goes, whether it is transformed or hashed, which party receives it, and what the stated purpose is.
Network capture and script instrumentation can provide that evidence.
The Surveillance Economy becomes most revealing where interface assumptions and software behavior diverge.
The button says Submit.
The code may have started listening several keystrokes ago.