Privacy Policy

The short version

This site has no backend. It is static files served from a CDN, and every generator runs entirely in your browser. There is no database, no account system and no endpoint that could receive a generated value.

• No generated value is ever sent anywhere, logged anywhere or stored anywhere.
• Google Analytics records which pages are visited. It never receives a generated value, and your generator settings are removed from every address before it sees one.
• Google Analytics sets its own cookies to tell returning visitors from new ones, except in the EEA, the UK and Switzerland, where it runs without cookies. There are no ads today; if Google AdSense is added, the advertising section below describes the cookies it uses.
• Your generator settings are kept in localStorage in your own browser and nowhere else.
• The CDN that serves the files receives ordinary HTTP request logs, the same as any web server. That is covered below.

The values you generate

Generation happens in JavaScript running in your tab. The value exists in a variable in the page and in the DOM node that displays it. It goes nowhere else. There is no request to send it in, because generation never issues a request at all.

Generated values are not written to localStorage, not written to sessionStorage, not placed in the URL, not logged to the console and not included in any error handling. Console logging of generated output is prohibited in the codebase, because a secret printed to the console outlives the page inside devtools history.

Copy writes to your system clipboard, which belongs to your operating system, not to this site. Download builds the file in the page from a Blob and hands it to the browser. Neither operation touches the network.

When you reload or close the tab, the values are gone. Nothing here can retrieve a value you generated earlier, including us.

What is stored in your browser

Generator settings are saved to localStorage under a versioned key, so that returning to the site gives you the length, character sets, constraints and quantity you used last time. Pages built around one specific setting, such as a 32-character or a binary string generator, always open with that setting instead. This data is per-browser and per-device, is readable only by pages on this domain, and never leaves your machine. Clearing site data in your browser removes it completely, and the generators work identically without it.

What localStorage does not hold is any generated value. There is no history feature and no cache of previous output.

Some generator settings can also be carried in the URL query string, so that a configuration can be shared or bookmarked. Settings shared that way are visible in the link you share, which is the point of the feature. They are removed from the address before Google Analytics records the page. Generated values are never placed in a URL.

Cookies

This site's own code sets no cookies. Nothing in it reads or writes document.cookie.

Google Analytics sets two cookies on this domain, _ga and _ga_MC51YGZ552. They hold a random identifier and timestamps so that a returning browser can be told from a new one, and nothing you generated or chose. They last up to two years, and clearing this site's data in your browser removes them.

In the European Economic Area, the United Kingdom and Switzerland, analytics cookies are off by default. Google Analytics sends measurements without cookies there, so neither cookie is set. If advertising is added, Google and its partners will set cookies as described in the advertising section, and where the law requires consent a consent prompt will be shown before any advertising cookie is set.

Analytics

This site uses Google Analytics 4 to count which pages are read and where visitors arrive from. Every page loads a script from googletagmanager.com and sends measurements to google-analytics.com.

Google receives the address of the page, its title, the page you came from, your browser's language, screen size and user agent, and an approximate location that Google derives from your IP address. Google states that Google Analytics 4 does not log or store IP addresses. Depending on its settings it can also record scrolling, clicks on links to other sites and time spent on a page.

It never receives a generated value, the custom character set you type, or your generator settings. The generator keeps its settings in the address bar so that a configuration can be shared, and those settings are removed from the page address and from the address of the page you came from before any measurement is sent. Campaign tags such as utm_source are kept. Changing a setting updates the address without notifying Google Analytics, so it is not recorded as a new page view.

Generating makes no request at all. In the network panel of your browser devtools, requests to Google appear when a page loads, and none appear when you press Generate.

The analytics script runs in the same page as the generator. Nothing in this site's code passes a generated value to it, but a third-party script loaded into a page can technically read that page. If that matters for a particular secret, generate it with a content blocker enabled or with the network disconnected. The generators work identically either way.

You can stop Google Analytics on this site with a content blocker or with Google's opt-out browser add-on.

• Google Analytics opt-out browser add-on
• How Google uses information from sites that use its services

What the hosting provider sees

The site is served as static files from a content delivery network. Delivering a page means the CDN receives an HTTP request, and like every web server it records ordinary request metadata: the source IP address, the user agent string, the requested path, a timestamp and the response status. This happens for the HTML document, the stylesheet and the script, exactly as it does for any site on the web.

We do not control those logs, do not read them and do not use them for anything. They are a property of how HTTP works rather than a decision made here. They contain no generated value, because values are produced after the page has finished loading and are never requested from or sent to a server.

If request metadata is itself a concern for your threat model, the honest answer is that you can load a page once and then work offline. Everything on it keeps functioning with the network disconnected, which is also the fastest way to verify the rest of this page.

Advertising

There are no ads on this site today. This section describes how advertising will work if it is added, so that the policy is in place before anything changes rather than after.

If ads are shown, they will be served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites.

Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and to other sites on the internet. Those cookies are set and read by Google, not by this site, and this site has no access to them.

You can opt out of personalised advertising in Google's Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info, or at youronlinechoices.eu if you are in Europe. Non-personalised ads still use cookies for frequency capping, aggregated reporting and fraud prevention.

An ad script runs in the same page as the generator. Nothing in this site's code passes a generated value or your settings to it, and ads will sit below the tool rather than beside its output. A third-party script loaded into a page can technically read that page, though, so if that matters for a particular secret, generate it with an ad blocker enabled or with the network disconnected. The generators work identically either way.

• Google Ads Settings (adssettings.google.com)
• How Google uses information from sites that use its services
• Google advertising policies and cookies
• Opt out of third-party vendors (aboutads.info)
• Your Online Choices (Europe)

Third parties

Google Analytics is the only third-party script on this site. There is no ad network, no session recorder, no social widget, no embedded video, no comment system and no chat widget. If Google AdSense is added, it will be the second, and this page will be updated on the day it happens.

Fonts are self-hosted rather than loaded from a font CDN, so rendering a page does not disclose your visit to a font provider. Apart from Google Analytics, pages make no requests to other origins, which you can confirm in the network panel of your browser devtools.

Your data, and corrections to this page

This site has no accounts, no mailing list and no database, and it never asks for your name or email address. The measurements Google Analytics collects are stored by Google and shown to this site as reports of pages, counts and approximate locations. Clearing this site's data in your browser removes the analytics identifier. Data collected by Google, through analytics now or advertising if ads are added, is governed by Google's own privacy policy and controls, linked above.

If you believe anything on this page is inaccurate, including something you observed in your own devtools that contradicts it, email the address below. A privacy claim that turns out to be wrong is the most serious kind of error this site could make, and it would be corrected and recorded in the changelog rather than quietly edited.

• [email protected]