Zero Password Data
We never see, store, or transmit any password you type. Full stop. (The one opt-in exception — a privacy-preserving breach check — is detailed in Section 5.)
Client-Side Only
All analysis runs in your browser. No server receives your input.
Analytics & Ads
We use Google Analytics and AdSense. Neither ever sees your passwords.
Table of Contents
1. Overview
PasswordStrength.net ("we", "us", "our") operates a free password security tool available at passwordstrength.net. This Privacy Policy explains how we handle information when you use our website.
The short version: we built this tool to be private by design. The core functionality — password analysis and generation — runs entirely in your browser using JavaScript. Your passwords are never sent to any server, never logged, and never stored.
🔒 The most important thing to know: PasswordStrength.net has no server-side component that processes passwords. The zxcvbn library runs locally in your browser tab. You could disconnect from the internet after the page loads and the tool would still work.
2. What We Don't Collect
To be completely explicit, we do not collect, transmit, store, or process:
- Any password you enter into the strength checker, in full or in any reversible form
- Any password generated by the password generator, in full or in any reversible form
- Keystroke data or timing data from the password input
- Any form of behavioral tracking tied to specific users
- Your name, email, or any personally identifying information unless you contact us
- Location data beyond country-level (from analytics)
- Device fingerprints or cross-site tracking identifiers
The one exception: if you click the optional "Check for Breaches" button on the checker or generator, your browser sends the first 5 characters of a SHA-1 hash of that password to the Have I Been Pwned "Pwned Passwords" API to check it against known breaches. This is called k-anonymity — the partial hash is shared by hundreds of unrelated passwords and cannot be reversed back into your actual password. This request only ever happens when you explicitly click the button; it is never automatic. See Section 5 for details.
3. What We Do Collect
We use privacy-respecting, aggregated analytics to understand how many people use the site and which pages are most visited. This data is:
- Aggregated — we see counts, not individual user journeys
- Non-identifying — we cannot trace any statistic to a specific person
- Not shared — we do not sell or share analytics with third parties for advertising
Our server logs may also temporarily store standard HTTP request data (IP address, browser, timestamp) for security and abuse prevention purposes. These logs are automatically purged after 7 days and are never used for profiling.
4. Cookies & Local Storage
We do not set any persistent tracking cookies. The only browser storage we use:
- Session state — which tab you're on (checker vs. generator). This is discarded when you close the tab.
- Password history — the "Recent Passwords" feature stores generated passwords in your browser's
sessionStorage. This is local to your browser, never transmitted to us, and is erased when you close the tab.
Note on fonts: Our typography (DM Sans, DM Mono) is self-hosted from our own domain — we no longer load fonts from Google Fonts, so no font-related request is sent to Google.
Analytics and advertising cookies: Google Analytics sets cookies (such as _ga, _gid) to distinguish users and track sessions. Google AdSense sets cookies to deliver and measure advertisements. These cookies persist for up to 2 years. You can manage or delete them via your browser settings or opt out using the links in Section 5.
5. Third-Party Services
We use the following third-party services. None of these receive your passwords:
- Google Analytics — we use Google Analytics to understand aggregate site usage (pages visited, session duration, general geography). Google Analytics sets cookies and may collect your IP address. Data is processed by Google under their Privacy Policy. We have enabled IP anonymisation. You can opt out via the Google Analytics Opt-out Browser Add-on.
- Google AdSense — we display advertisements served by Google AdSense. Google may use cookies and device identifiers to show you personalised ads based on your interests and browsing behaviour. You can manage ad personalisation at Google Ad Settings. For more information see Google's advertising policies.
- Have I Been Pwned — Pwned Passwords API (
api.pwnedpasswords.com) — used only if you click the optional "Check for Breaches" button. We send the first 5 characters of a SHA-1 hash of the password (never the password or its full hash) using the k-anonymity method documented at haveibeenpwned.com. This request is never sent automatically. See How it Works for a full explanation.
Note: Neither Google Analytics nor Google AdSense ever receives any password you type. All password analysis runs locally in your browser before these services load. The only third-party service that ever receives anything password-related is the optional, opt-in breach check described above — and even then, only an irreversible partial hash fragment, never the password.
6. Contact Form Data
If you use our Contact page to send us a message, we collect:
- Your name (as provided)
- Your email address (as provided)
- The content of your message
This data is used solely to respond to your enquiry. We do not add you to any mailing list without explicit opt-in, and we do not share your contact details with third parties. Contact data is retained for up to 12 months and then deleted.
7. Your Rights
Depending on your location, you may have rights regarding your personal data under GDPR, CCPA, or other applicable laws. These include the right to access, correct, or delete data we hold about you.
Since we collect essentially no personal data in normal site use, exercising these rights is straightforward. If you've contacted us and want your message deleted, email us at privacy@passwordstrength.net and we'll remove it within 5 business days.
8. Children's Privacy
PasswordStrength.net is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted contact information to us, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this policy as our service evolves. If we make material changes that affect how we handle your data, we'll update the "Last Updated" date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy.
We will never silently change our stance on password data privacy — if anything changes there, we will communicate it prominently on the site.
10. Contact Us
If you have questions about this Privacy Policy or our data practices, you can reach us through our Contact page or by email at privacy@passwordstrength.net.
For security disclosures specifically, please use the subject line "Security Disclosure" and we'll treat it as priority.