Security & Transparency

We believe in radical transparency. Here's proof that your passwords never leave your device.

Client-Side Generation: Proof

All password generation happens in your browser using the Web Crypto API. Here's how to verify it yourself:

Step 1: Open Developer Tools

Press F12 (or Cmd+Option+I on Mac) to open your browser's developer tools.

Step 2: Go to Network Tab

Click on the "Network" tab in developer tools.

Step 3: Generate a Password

Go back to our password generator and click "Generate Password".

Step 4: Check Network Requests

Look at the Network tab. You'll see:

✅ Page load requests (HTML, CSS, JS)
✅ API calls you explicitly trigger (for example breach checks), if you use those features
❌ NO password data sent anywhere

Visual Proof

Here's a screenshot of our Network tab during password generation:

Network tab showing no password data transmitted

Note: If the image doesn't load, you can verify this yourself using the steps above.

How It Works (Technical)

Our password generator uses the Web Crypto API's crypto.getRandomValues() function:

// Simplified version of our generation code
const passwordArray = new Uint8Array(length);
window.crypto.getRandomValues(passwordArray);

let password = '';
for (let i = 0; i < length; i++) {
    password += allChars[passwordArray[i] % allChars.length];
}
// Password is displayed in browser - never sent to server
                

This code runs entirely in your browser. The random values are generated using your device's cryptographically secure random number generator. We never see the password because it's never transmitted.

Open Source Code

You can audit our code yourself. Our entire codebase is open source and available on GitHub:

View Source Code on GitHub →

Feel free to:

Review the password generation logic
Check for any network requests
Verify our privacy claims
Fork and modify for your own use

What We Do Track (And Why)

We do not load Google Analytics, Meta Pixel, or similar third-party trackers on the password generator. Standard web hosting may log basic technical data (for example IP address in server logs) as described in our privacy policy.

We do NOT track:

❌ Generated passwords
❌ Password length or character choices
❌ Copy actions
❌ Cross-site advertising or behavioral profiles

Privacy Policy

For complete details on our data collection practices, see our Privacy Policy.

Questions?

If you have questions about our security practices or want to report a concern, please contact us.