Privacy policy
Short version: your passwords never reach us, and we do not track you.
Passwords and anything you type
Passwords, passphrases, PINs and strings are generated in your browser and are never transmitted to or stored on our server. Text you type into the strength checker is analysed in your browser and is not transmitted.
The optional breach check
If you press "Check against known breaches", your browser sends the first 5 characters of the SHA-1 hash of the password to the Have I Been Pwned API at api.pwnedpasswords.com. Neither the password nor its full hash is sent. That request goes directly from your browser to Have I Been Pwned, not through us, and is subject to its privacy policy.
Settings stored on your device
Your chosen options, such as length and character types, are saved in your browser's local storage so the page opens the way you left it. They never leave your device. Clear your browser's site data to remove them.
Server logs
Like any web server, ours records standard request logs: IP address, time, page requested and browser type. They are used to keep the site running and secure and are deleted on a rolling basis. They never contain passwords, because passwords are never sent.
No cookies, no tracking
The site sets no cookies and loads no analytics, advertising or social media scripts.
Contact
Questions about this policy can be sent through fourcents.ca.