Privacy Policy
Every generator here makes a claim about privacy. This page is where that claim has to hold up.
This site has no accounts and no way to receive what you type. Everything you generate or paste stays in your browser and is gone when you close the tab. It does use Google Analytics to count visits, which sets cookies — that is the one thing on this page that is not "none", and it is described in full below.
What never leaves your browser
Every tool on this site runs as JavaScript already loaded in the page. There is no server to send anything to — the site is a set of static files, and none of them can receive data.
That covers, without exception:
- Every password, passphrase, PIN, key, salt, UUID, code and string generated here.
- Anything you type into the strength checker.
- Anything you type into the hash generator.
- Every setting you change — length, character sets, algorithm, quantity.
None of it is transmitted, written to a database, stored in your browser, placed in the URL, written to a server log, or attached to an analytics event. Closing the tab is the end of it.
Nothing is remembered between visits
The site writes nothing to localStorage, sessionStorage or IndexedDB. Reload the page and every tool starts from its defaults, because there is nowhere for a previous value to have been kept.
Your clipboard is only ever touched when you press a copy button.
How to check this yourself
Do not take any of it on trust. Every site in this category makes the same claim, and the claim costs nothing to make. These three checks take about a minute and none of them requires taking our word for anything.
1. Disconnect from the internet
Load any tool page, turn off your Wi-Fi, then use it. Everything keeps working — generating, hashing, checking strength. A tool that needed a server could not do that.
2. Watch the network
Open your browser's developer tools, switch to the Network panel, and use any tool. No request appears. Nothing is sent when you type, when you generate, or when you copy.
3. Read the code
View source. The generators are plain JavaScript and readable. Search them forMath.random and you will find nothing — every random value on this site comes from crypto.getRandomValues().
What is collected
Saying "we collect nothing" would be neat and slightly untrue, so here is the actual position, split into what this site does and what hosting a website unavoidably involves.
By this site: page views, through Google Analytics
The site uses Google Analytics 4 to count page views and see which pages people arrive on. It loads a script from googletagmanager.com and sends its measurements togoogle-analytics.com. What it records is what a page counter records: which page, roughly where in the world, which browser and device family, and which site linked to it.
It sets cookies. Google Analytics stores _ga and a_ga_ identifier in your browser so that two page views in the same visit can be counted as one visit rather than two. They are first-party cookies, they hold a random number and not a name or an address, and they are the only cookies this site sets.
It has no access to anything inside the page. Values you generate and text you type are not available to it: nothing is written into the URL, and there are no custom events of any kind. The analytics can only see that a page was loaded.
Google is a third party with its own purposes. If you would rather not be counted, a tracker blocker, a browser that blocks third-party scripts, or Google's own opt-out will all stop it, and every tool on this site works exactly the same either way — the generators never needed the network to begin with.
By the host: IP addresses, to deliver and protect the site
The site is served by Cloudflare Pages. Like any host, it processes the IP address of each request in order to route it and to block attacks. That is a technical necessity of putting a site on the internet rather than a choice this site made, and it happens before any of our code runs.
Cookies, storage and tracking
- Cookies: Google Analytics only, as described above. None for preferences, none for advertising, and none set by anything else on the site.
- Browser storage: none, as described above.
- Advertising: none. No ad networks, no remarketing, no advertising pixels.
- Third-party embeds: none. No comment widgets, no social buttons, no chat.
Nothing you generate is involved in any of this. The analytics cookie counts a visit; it cannot see a password, because the password is never anywhere it could reach.
Third parties
The fonts are served from this domain rather than from Google Fonts, so loading a page makes no request to a font provider. There are no external stylesheets and no embedded frames. The analytics loader is the only script that comes from anywhere but this domain.
Two third parties are involved: Cloudflare, which hosts the site, and Google, which provides the analytics described above. Nothing else. There are no external links to follow — this site does not link out at all.
Your rights
Rights like access, correction and deletion apply to personal data held about you. This site holds none: there is no account, no profile, no record of what you generated, and nothing tied to you as an individual. There is nothing to hand over or erase because nothing was ever kept.
If you believe something on this page is inaccurate, that is worth telling us about — see Contact.
Children
The site is not directed at children and collects no personal data from anyone, of any age.
Changes to this policy
The date at the top is the last time this page changed. If the site ever starts doing something this page says it does not, this page changes in the same release — not afterwards.
A concrete example of what that means: the content security policy inpublic/_headers names every host allowed to run a script, and a build check refuses to ship a page the policy would block. Adding a tracker means editing that file, which is the same commit that has to edit this page. Google Analytics was added that way — this section is what changed with it.
Questions
Email [email protected], or see Contact for what is most useful to send.