Privacy

Generators and checkers

Every password, passphrase, PIN, key, UUID, hash and TOTP code on this site is created in your browser with the Web Crypto API. We have no server that sees them, and we don’t log them.

Settings saved in your browser

To save you re-entering choices, tools remember their settings (such as password length or character types, and the form fields of the policy generator) in your browser’s local storage under keys starting with sg:. Generated passwords, keys and secrets are never saved. This data never leaves your device.

Breach check

If you press “Check against known breaches” on the strength checker, your browser sends the first 5 characters of the password’s SHA-1 hash to the Have I Been Pwned Pwned Passwords API (run by Troy Hunt, served via Cloudflare). The full hash and the password never leave your device. It only happens when you press the button.

Password policy writer

When you press “Write my policy”, the organisation details you typed in that form are sent to our server and passed to an AI model through Vercel AI Gateway to write the draft. No passwords are involved. We don’t store the request or the response.

Analytics

We use Ahrefs Web Analytics to count page views. It is cookieless and does not track you across sites. Hosting is provided by Vercel, which keeps standard server logs.