PasswordSecure.org
Privacy policy
What we collect, what we store, and what leaves your device.
In short: we collect no personal data, we run no analytics, we use no tracking cookies and we show no advertising. You do not have to take our word for it — the detail of everything that happens is below.
What data we process
None. PasswordSecure.org has no user accounts, asks for no email address, includes no sign-up forms and has no database in which to store visitor information.
The passwords and passphrases you generate are created entirely inside your browser, using your own device's cryptographic generator (crypto.getRandomValues). They are never sent to any server, ours or anyone else's.
Cookies
We use no cookies at all — not first-party, not third-party, not analytics, not advertising.
We do store two things in your browser's local storage, which is a different technology: it is not sent to the server with every request and nobody else can read it.
- Your theme preference (light or dark), so you do not have to pick it on every visit.
- The last 15 passwords you copied, and only if you use the history tab. They are stored unencrypted, which is why we warn you in the tab itself not to use it on a shared computer.
Both stay on your device. You can remove them at any time with the "Clear history" button or by clearing the site data in your browser.
The one external request: the checker
When you use the breached-password checker, we query the Have I Been Pwned database using a method called k-anonymity.
It works like this: your browser computes the SHA-1 hash of the password and sends only the first 5 characters of that hash. The service returns every hash starting with those characters — hundreds of them — and the final comparison happens on your device. Neither the password nor its full hash ever leaves your browser.
That request does mean your IP address is visible to that service's provider, as with any request on the internet. It is the only communication with a third party anywhere on the site, and it only happens if you type something into the checker.
No third-party resources
Everything the site loads is served from our own domain: stylesheets, scripts, icons and the fonts too. We do not use Google Fonts, external CDNs, or any service that could log your visit. Your browsing here is not shared with anyone.
Server logs
Our hosting provider generates automatic technical logs (IP address, date, page requested and browser), which are necessary to operate and secure the service. We do not use them for profiling and do not combine them with any other information; they are retained for the period our provider applies.
Your rights
The General Data Protection Regulation grants you rights of access, rectification, erasure, objection, restriction and portability. Since we store no identifiable personal data, in practice there is nothing to retrieve or delete.
If you still have any question about privacy, you can reach the team that maintains this site through megaoryx.com.
Changes to this policy
If anything described here changes in the future, we will update this page. The last-modified date is reflected automatically in the site's structured data.