Our Privacy Promise
A plain-language summary of what we collect, what we don't, and why. For the full legal terms, see our Privacy Policy.
Our philosophy
A password tool is one of the few pieces of software where the right architecture isn't "collect data and secure it well" — it's "never collect the sensitive data in the first place." Flassword is built around that idea. If something you generate or check never needs to leave your browser to do its job, it doesn't.
What we collect
- Standard, aggregated web analytics (pages visited, approximate location by country/region, device type) if you consent to analytics cookies.
- Your dark mode preference, stored locally so the site remembers it on your next visit.
- Whatever you choose to include in an email if you contact us directly.
What we never collect
- Passwords, passphrases, PINs, or any value generated or typed into our tools.
- The text you hash, encode, or decode with our developer tools.
- Any password you enter into our Password Strength Checker or Password Breach Checker.
- Account credentials of any kind — we don't have user accounts to begin with.
Local, client-side processing
Every generator and checker on Flassword runs entirely inside your browser using the Web Crypto API. Generation, hashing, and encoding happen on your device; nothing about the input or output is transmitted to us. The one deliberate exception is our Password Breach Checker, which needs to consult an external breach database — even then, only a five-character fragment of a cryptographic hash is sent, never the password itself, using a privacy-preserving technique called k-anonymity that we explain on that tool's own page.
Cookies
We use a small number of cookies for essential site function and, if you consent, for analytics and advertising measurement through providers such as Google. You control this through the cookie banner shown on your first visit, and you can change your choice at any time. See our full Privacy Policy for the complete list of cookies in use.
Transparency
Where a tool does something that touches the network — right now, only the breach checker — that behavior is disclosed directly on the tool's own page, not just buried in a policy document. If that ever changes for any other tool, we'll disclose it the same way, in the same place you're using the tool.
Security
All pages are served over HTTPS. Because so little data ever reaches a server in the first place, the practical attack surface for anything sensitive you generate is dramatically smaller than on a typical web app — there's simply very little of yours for us to lose.
Questions about any of this? Get in touch — we're glad to explain further.