Privacy
SecPassGen has nothing to disclose, because it keeps nothing. This page states exactly what that means, including the parts that are less flattering.
In short
Passwords are generated on your device and never leave it. There is no database, no account, no analytics, and no cookie. After the page loads it makes zero network requests, and the page shows you that count live.
What is not stored
- Passwords
- Never transmitted, never persisted anywhere
- Generated history
- Browser only, encrypted, 24 hour expiry
- Accounts
- None exist. There is nothing to sign up for
- Usage analytics
- Not collected in any form
- Cookies
- None set by this site
- Advertising identifiers
- Not used
Common questions
+Does SecPassGen store my passwords?
No. Passwords are created by your own browser using the Web Crypto API and are never transmitted to us. We operate no database, so there is no record of any password to disclose, sell, or lose.
+Can you recover a password for me?
No, and that is deliberate. Because we never receive the password, we hold nothing that could be returned. A service that could recover your password is a service that had your password.
+Does the page send anything to your server?
Once the page has loaded, it makes no network requests at all. The page displays a live count of data requests measured by your own browser, and it reads zero. If that number were ever anything else, the claim would visibly stop being true.
+What is the entropy floor?
Every password is held to a minimum of 60 bits of entropy, measured as length times log2 of the alphabet size. A password below that is refused rather than served. At or above it, the chance of a repeat is small enough to be unobservable, which is why no stored list of issued passwords is needed.
+What is the Recent panel?
A short history kept only in your browser, encrypted with AES-GCM, holding at most 10 entries and expiring after 24 hours. It is never uploaded. Clearing your browser data removes it.
+Do you use analytics or tracking?
None. There is no analytics script, no tracking pixel, no cookie, and no third-party request of any kind on this site.
The parts worth being honest about
Your host still sees the request
This site is served by Vercel. Like any web host, Vercel may process standard request metadata such as IP address and user agent in order to deliver files. That is infrastructure, not product analytics, and we cannot switch it off from here. It matters only in one respect, and that respect is favourable: the traffic contains no password, because no password is ever sent.
Local history is obfuscated, not vaulted
The Recent panel is encrypted with AES-GCM, but the key is derived from a coarse device fingerprint such as browser language and screen size. That is enough to stop casual inspection of browser storage. It is not protection against someone who already has your machine. We would rather say this plainly than let the word "encrypted" imply more than it delivers here.
Your clipboard is yours
Copying puts the password on your system clipboard, where other software may be able to read it. We cannot control that, and it is the main practical way a generated password can leak. Paste it into a password manager and clear your clipboard when you are done.
Changes
This policy describes the service as it actually behaves. If the behaviour ever changes, this page changes with it, in the same commit.