Security & Privacy

Yes. Once the page loads, most tools work entirely offline.

All cryptographic and data processing uses your browser's built-in capabilities. You can generate passwords, compute hashes, encode and decode data, and inspect tokens without any internet connection.

The only exception is the Breach Checker, which needs network access to query the Have I Been Pwned API (using a privacy-preserving k-anonymity model). For everything else, feel free to disconnect from Wi-Fi and work with complete network isolation.

The Breach Checker uses a k-anonymity model to keep your password private.

Only the first 5 characters of your password's SHA-1 hash are sent to the Have I Been Pwned API. The API returns a list of matching hash suffixes, and the comparison happens locally in your browser. Your full password, full hash, or plaintext is never transmitted.

Even if the API were compromised, an attacker could only determine that someone with a similar hash prefix queried their service — never your actual password.

We keep dependencies minimal and audited.

For core algorithms, BetterPass relies on the browser-native Web Crypto API (SHA-2, HMAC, PBKDF2, and random number generation) — no third-party code needed.

For algorithms not available in the Web Crypto API, we use audited open-source libraries:

• @noble/hashes for SHA-3 (0 dependencies)
• bcryptjs for Bcrypt
• @noble/ciphers for XChaCha20-Poly1305 (used in PASETO)

All dependencies are pinned to specific versions and reviewed for security. The site also uses Google AdSense for advertising — a separate third-party script that does not interact with your tool data.

Your data stays safe — because your data never reaches our servers.

Tool inputs and outputs never leave your browser. A server compromise would expose static website files, analytics data, and ad scripts — but no passwords, hashes, tokens, or user-generated content. There is no database of tool results to steal.

The worst-case scenario is a supply-chain attack where an attacker modifies the served JavaScript. That's why we pin all third-party dependencies to specific versions and keep the dependency list as small as possible.

We collect standard web analytics — page views, referral source, and general location — through Google AdSense and web analytics.

This data is aggregated and cannot be linked to your specific tool inputs or outputs. No passwords, hashes, tokens, or any tool-generated data is collected, logged, or stored.

The analytics and advertising scripts run in separate browser contexts and have no access to your tool data.