Effective date: 1 January 2025
Overview
PassGeneratorTool is designed to be a privacy-first website. Our core tools generate passwords entirely in your browser. We do not have a server-side password-generation API, and we do not receive, store, or transmit the passwords you generate.
What We Do Not Collect
- Generated passwords. All password generation happens inside your browser. Your passwords are never sent to us.
- Passwords you type into our analysis tools. Strength, entropy, and crack-time calculations happen in your browser using JavaScript. Your passwords do not leave your device.
What We May Collect
Like almost all web servers, our hosting provider's access logs may record standard HTTP request data: your IP address (typically anonymised), the URL requested, timestamp, browser type, and HTTP status code. This is standard server logging, not user tracking.
We do not use third-party advertising networks. We do not use cross-site tracking cookies.
Analytics
If we use analytics, it will be privacy-respecting analytics (e.g. aggregate page view counts) that does not involve individual tracking. We will update this policy if analytics is added.
Password Leak Checker (HaveIBeenPwned API)
Our Password Leak Checker uses the HaveIBeenPwned k-anonymity API. When you check a password, we compute its SHA-1 hash in your browser and send only the first 5 characters of that hash to the API. Your full password and full hash are never transmitted. This is a published, open k-anonymity protocol.
Your Rights
Because we do not collect personal data beyond standard server logs, most data-subject requests (access, deletion, portability) do not apply. If you have privacy questions, please contact us.
Changes to This Policy
We will update this page with an effective date if our privacy practices change materially.