OnePassword

Privacy Policy

Every generator here makes a claim about privacy. This page is where that claim has to hold up.

Last updated

This site has no accounts, no cookies and no way to receive what you type. Everything you generate or paste stays in your browser and is gone when you close the tab.

What never leaves your browser

Every tool on this site runs as JavaScript already loaded in the page. There is no server to send anything to — the site is a set of static files, and none of them can receive data.

That covers, without exception:

  • Every password, passphrase, PIN, key, salt, UUID, code and string generated here.
  • Anything you type into the strength checker.
  • Anything you type into the hash generator.
  • Every setting you change — length, character sets, algorithm, quantity.

None of it is transmitted, written to a database, stored in your browser, placed in the URL, written to a server log, or attached to an analytics event. Closing the tab is the end of it.

Nothing is remembered between visits

The site writes nothing to localStorage, sessionStorage or IndexedDB. Reload the page and every tool starts from its defaults, because there is nowhere for a previous value to have been kept.

Your clipboard is only ever touched when you press a copy button.

How to check this yourself

Do not take any of it on trust. Every site in this category makes the same claim, and the claim costs nothing to make. These three checks take about a minute and none of them requires taking our word for anything.

1. Disconnect from the internet

Load any tool page, turn off your Wi-Fi, then use it. Everything keeps working — generating, hashing, checking strength. A tool that needed a server could not do that.

2. Watch the network

Open your browser's developer tools, switch to the Network panel, and use any tool. No request appears. Nothing is sent when you type, when you generate, or when you copy.

3. Read the code

View source. The generators are plain JavaScript and readable. Search them forMath.random and you will find nothing — every random value on this site comes from crypto.getRandomValues().

What is collected

Saying "we collect nothing" would be neat and slightly untrue, so here is the actual position, split into what this site does and what hosting a website unavoidably involves.

By this site: page views, with no personal data

The site uses Cloudflare Web Analytics to count page views. It sets no cookies, assigns no identifier, and cannot follow you between sites or between visits. What it records is the kind of thing a page counter records: which page, roughly where in the world, which browser family, which site linked to it.

It has no access to anything inside the page. Values you generate and text you type are not available to it, and there are no custom events carrying that data — the analytics can only see that a page was loaded.

By the host: IP addresses, to deliver and protect the site

The site is served by Cloudflare Pages. Like any host, it processes the IP address of each request in order to route it and to block attacks. That is a technical necessity of putting a site on the internet rather than a choice this site made, and it happens before any of our code runs.

Cookies, storage and tracking

  • Cookies: none. Not for analytics, not for preferences, not for anything.
  • Browser storage: none, as described above.
  • Advertising: none. No ad networks, no remarketing, no tracking pixels.
  • Third-party embeds: none. No comment widgets, no social buttons, no chat.

Because no cookies are set and no personal data is collected, there is no consent banner. That is not a loophole — there is genuinely nothing to consent to.

Third parties

The fonts are served from this domain rather than from Google Fonts, so loading a page makes no request to a font provider. There are no CDN-hosted scripts, no external stylesheets and no embedded frames.

The only third parties involved are Cloudflare, which hosts the site and provides the analytics described above, and whichever links you choose to follow — every external link on this site points at a specification, a standards body or a piece of published research, and following one takes you to a site with its own policy.

Your rights

Rights like access, correction and deletion apply to personal data held about you. This site holds none: there is no account, no profile, no record of what you generated, and nothing tied to you as an individual. There is nothing to hand over or erase because nothing was ever kept.

If you believe something on this page is inaccurate, that is worth telling us about — see Contact.

Children

The site is not directed at children and collects no personal data from anyone, of any age.

Changes to this policy

The date at the top is the last time this page changed. If the site ever starts doing something this page says it does not, this page changes in the same release — not afterwards.

A concrete example of what that means: the content security policy that allows the analytics script is set in the same file that would have to change to allow any other third-party script. A new tracker cannot be added quietly without that file, and this page, changing too.

Questions

Email contact@onepassword.net, or see Contact for what is most useful to send.