Privacy Policy
The short version: everything you generate, type or hash on this site stays in your browser. The site uses Google Analytics, which sets cookies to measure how pages are used.
Privacy Policy Summary
- Passwords, passphrases, PINs, keys and other values are created in your browser.
- Nothing you generate, type, paste or hash is sent to our server or stored by us.
- The site uses Google Analytics to measure how pages are used. It sets cookies and sends usage data to Google.
- There is no advertising, and analytics never receive the passwords or other values you generate.
- Like any website, the hosting infrastructure may record technical request data, such as your IP address and the page requested.
How Password Generation Is Processed
The generators run as JavaScript in your browser tab. Random values come from crypto.getRandomValues() (and crypto.randomUUID() for UUIDs), the browser's cryptographically secure random number generator. Large batches run in a Web Worker, a background thread of the same page. Hashes are calculated with crypto.subtle.digest(); a file you choose for hashing is read on your device and never uploaded.
Generated values are not transmitted: no network request is made while you generate, copy, download or hash. They are not stored by us either - they exist in the page until you close it, regenerate or leave. A file you download is created in your browser and saved by your browser.
Tool settings, such as the password length, are kept in the part of the address after #. Browsers do not send that part to the server, but it does appear in your browser history. The generated password itself is never put in the address.
The clipboard
When you press Copy, the value is placed on your device's clipboard. For passwords and other secrets, the page overwrites the clipboard after 30 seconds if the tab is still active. Clipboard-history features of your operating system or other apps may keep their own copy; we cannot control or delete it.
How the Password Strength Checker Works
The strength checker analyses what you type in your browser, using the open-source zxcvbn-ts estimator and its dictionaries. The estimator is downloaded from this domain the first time you click into the field; after that, typing makes no network request. The password you type is not sent, logged or stored, it is hidden on screen by default, and the field is cleared when you leave the page.
Analytics
The site loads Google Analytics (Google) to measure how pages are used - for example which pages are visited and roughly where visitors come from. This service sets its own cookies and sends usage data to Google, which processes it under its own privacy policy.
It never receives the passwords, passphrases, hashes or other values you generate or type: those stay in the page and are never sent. The site's Content Security Policy allows scripts only from this domain and from Google, and blocks every other third-party, advertising, session-recording or social-media script. To opt out, use your browser's settings or an analytics-blocking extension.
Server and Hosting Logs
When your browser requests a page or file, the request reaches our hosting infrastructure. Our own web server does not write logs of individual requests. The hosting provider and the network in between may record standard technical data in their own logs, such as your IP address, the time, the requested path, and your browser's user agent. These requests never contain anything you generate or type, because none of it is sent.
The site is hosted by Railway. How it processes and retains such data is described in Railway's privacy policy.
Third-Party Services
Apart from the hosting provider and the analytics described above, no third-party service is involved when you use the site. Fonts, the EFF wordlist and the strength checker's dictionaries are served from this domain. Your browser also contacts Google for the analytics script. Links to external sources, such as standards documents in the guides, take you to those websites, which have their own privacy policies.
Data Retention
We do not collect or store personal data, so there is nothing for us to retain or delete. Technical logs kept by the hosting provider are retained according to its own policy, linked above.
Your Privacy Rights
Depending on where you live, data protection laws such as the GDPR may give you rights to access, correct or delete personal data about you, to object to or restrict its processing, and to complain to a data protection authority. The site itself collects and stores no personal data, so we will usually have nothing to return or delete; any data the analytics providers collect is handled under their own privacy policies. You can opt out of analytics with your browser's settings or an analytics-blocking extension, and you can contact us with any question about your data.
Children's Privacy
The site is not directed at children, and it does not knowingly collect personal data from anyone, including children. Anyone can use the tools without providing any information about themselves.
Changes to This Policy
If the way the site handles data changes - for example, if a feature ever needs to store something - this page will be updated before the change goes live, and the date below will change. The current version was last updated on October 13, 2026.
Contact
For questions about this policy or your data, write to hello@yourpasswordgenerator.com.
For how the tools work and how to verify these statements yourself, see How It Works.