Privacy
Short version: passwords you type on PassCheck never leave your browser. Here is everything that does.
Passwords
- Strength checker, compare, entropy calculator: scored in your browser by the open-source zxcvbn-ts library. Not sent, not logged, not stored.
- Password, passphrase and PIN generators: created in your browser with
crypto.getRandomValues. Not sent, not stored. - Hash generator: computed in your browser with the Web Crypto API and bcryptjs. Not sent.
- We don't use AI on passwords, and nothing on the site saves a password to local storage, cookies or our server.
Breach check
Only when you press the breach-check button, your browser computes the SHA-1 hash of the password and sends the first 5 hexadecimal characters directly to api.pwnedpasswords.com, run by Have I Been Pwned. The response is compared on your device. The request doesn't pass through PassCheck and carries no referrer. Have I Been Pwned (served via Cloudflare) sees your IP address and that 5-character prefix, which is shared by roughly a million possible passwords.
Password policy reviewer
On the NIST guidelines page, if you press "Review policy", the policy text you pasted is sent to our server and on to an AI model through Vercel AI Gateway to write the review. We don't store it. The box refuses input that looks like a single password, but please don't paste passwords or confidential information into it.
Analytics
We use Ahrefs Web Analytics, a cookieless analytics script, to count page views, referrers and approximate country. It never sees what you type into any field.
Storage on your device
The site stores nothing in local storage and sets no cookies of its own. Closing the tab clears everything you entered.
Hosting
The site is served by Vercel. Like any web host, Vercel processes standard request logs (IP address, URL, user agent) to deliver pages.
Last updated 27 September 2026.