The short version: your passwords never leave your device. Everything on PassGen — generating passwords, generating passphrases, and checking password strength — runs as JavaScript in the tab you are reading. There is no form submission, no account, and no server endpoint that receives what you type or generate.
Specifically
- No transmission: passwords and passphrases you generate, and passwords you type into the strength checker, are never sent over the network. You can disconnect from the internet after the page loads and every tool keeps working.
- No storage: nothing you generate or type is written to cookies, local storage, or any database. Close the tab and it is gone.
- No logging: there is no analytics, tracking pixel, or third-party script on these pages, so there is no log in which your input could appear. The site's own code contains no feature that records inputs.
- No third parties: the pages load no external fonts, scripts, or embeds. The only network requests are for the page files themselves from the hosting provider (Cloudflare Pages), whose standard server logs record page requests — URLs and IP addresses — but never page contents or anything typed into a tool.
What this means in practice
Treat generated passwords like any new secret: copy the one you need into your password manager, then close the tab. Avoid generating passwords on a device you do not trust — a compromised machine can observe any tool, including this one, and no website can design around that. If you want to double-check the claims above, open your browser's network monitor while using the tools: you will see no requests carrying your input, because there is no code here that could make one.
This page describes how the site works today. If the site ever adds a feature that changes any of the points above, this page will be updated to say so before the feature ships.