What you type never leaves your device. Every one of these tools is compiled to WebAssembly and runs inside this browser tab. There is no server to send anything to, and none of them makes a network request while it works. You can open your browser's network panel and use any of them: nothing goes out.
That matters more here than anywhere else in this workspace, because it is the whole reason the site exists. A password, an authenticator secret, a private key, an authorisation header and a file you are scanning for leaked credentials are all things that must not be pasted into somebody else's server — and the usual way to do each of these jobs online is to do exactly that.
Each tool remembers your settings, and remembers your input while it is small enough
to be worth keeping, under about eight kilobytes. It is kept in your browser's own
localStorage, on your machine, and is never transmitted. That is worth
knowing before you paste a secret you would rather not leave behind — clearing your
browsing data removes it, and a private window keeps nothing at all. Your chosen
language and theme are stored the same way.
The generators ask your browser's own cryptographic random source, and every result says which source it got. If that source is unavailable the tool says so on the result rather than quietly using a weaker one.
No account, no sign-up, no cookies of our own, no analytics script, no fingerprinting, no error reporting. The pages carry no third-party JavaScript except the advertising described below.
These pages carry advertising, which is what pays for hosting them. An advertising network sets its own cookies and sees your IP address and the page you are on, in the same way it does on any other site. It does not see what you type into a tool: that text is never part of the page's markup and is never sent anywhere. If you would rather it saw nothing at all, an ad blocker breaks none of the tools.
Opening a file reads it into the tab's memory and no further. Saving a result writes it with your browser's own download mechanism. Neither passes through a server.
None of the cryptography here has been audited. Each algorithm matches the vectors its own standard publishes, which proves it computes the right function; it does not prove there is no timing leak, and no test in this project could. Every result that rests on a cipher says so, and the tools that generate long-term keys were left out rather than written badly.
The same tools are also built as a desktop application. It has no network code at all — not for updates, not for anything — and stores its settings in one small file in your user configuration directory.
If this ever changes, this page changes with it, and the change will be visible in the project's history rather than announced quietly.