Privacy, in plain English.
Last updated: October 22, 2026. The short version: your passwords stay on your device. Everything else is listed below, including the two third parties involved. Questions? Write to contact@mystrongpassword.com.
Passwords never leave your device
The generator, passphrase generator, strength test and policy builder run entirely in your browser. Nothing you type or create is sent, stored or logged.
Breach check: 5 characters
Only the first 5 characters of a SHA-1 hash of your password are sent to Have I Been Pwned. Your password and its full hash never leave your device.
No accounts
There is no sign-up, no login and no profile. We cannot link anything you do here to who you are.
Analytics only with consent
Google Analytics loads only if you click "Allow analytics". Decline, and no analytics script or cookie is ever loaded.
No third-party fonts
Fonts are served from this site. Loading a page tells no font service who you are.
A real contact
Questions or a request about your data? Write to contact@mystrongpassword.com.
1. The tools
Passwords and passphrases are generated with your browser's Web Crypto API (crypto.getRandomValues()). Values exist only in the memory of the open tab and disappear when you leave or close it. The strength test analyses what you type locally and clears the field when you leave the page. The policy builder creates documents and scripts in your browser, and downloads are produced locally.
2. The breach checker
When you click "Check now", your browser computes the SHA-1 hash of the password and sends only its first 5 characters to the Pwned Passwords service run by Have I Been Pwned (api.pwnedpasswords.com). The service returns all known leaked hash suffixes that share those characters, padded with decoy entries, and the comparison happens on your device. As with any web request, the service receives your IP address and browser details. See the Have I Been Pwned privacy policy for how it handles them.
3. Analytics and cookies
With your consent, we use Google Analytics 4 to count page views and anonymous tool events (for example, "a password was copied", "a policy was downloaded"). These events never contain passwords, passphrases, hashes or anything you type. Google Analytics sets cookies and processes your IP address; IP anonymization is requested. If you decline, the analytics script is never loaded. You can change your choice at any time with the "Cookie settings" link in the footer.
We store a few preferences in your browser's local storage (not cookies): your color theme and your analytics choice. They never leave your device.
4. Fonts and hosting
Fonts are hosted on this site, so loading a page does not contact Google Fonts or any other font service. Our hosting provider keeps standard server logs (IP address, page requested, time) for security and reliability. After your first visit, a service worker caches the site, fonts included, on your device so the tools work offline.
5. Your choices and rights
You can use every tool without accepting analytics. You can clear the stored preferences at any time from your browser settings. Depending on where you live (for example under the GDPR in Europe or Law 25 in Quebec), you may have the right to access, correct or delete your personal data, and to withdraw your consent. Because we do not collect account data, analytics data is the only personal data we may hold. To exercise these rights, write to the address below.
6. Contact
For any question about this policy or your personal information, including access, correction or deletion requests, write to the person responsible for the protection of personal information at contact@mystrongpassword.com. We reply within 30 days.
Never send a password by email, including to us. We will never ask for one.
7. Changes
If this policy changes, we will update the date at the top of this page.