Tool pages answer how to generate a password, check strength, or encrypt a file right now. These notes cover where browser-local encryption runs, whether data leaves the tab by default, and how you can verify that in DevTools. Open and read—no inbox required first.
Title and excerpt match each article. Open and read—no account.
On 6 October 2026 the FBI and the U.S. Secret Service issued FortiBleed: reused passwords on internet-facing FortiGate devices log in directly, and leftover SHA-256 storage can be cracked offline. The original administrator can end up locked out after that account is changed or removed. Moving to a PBKDF2 release does not clear the old hash by itself.
On 25 September 2026 K7 Labs described a program that reads saved browser passwords and sessions. AES-256-GCM only means the field on disk is not plaintext. Windows DPAPI blocks other users and cold-boot attacks, not a program running as you. The cipher name does not say who holds the key.
On 25 September 2026 OpenAI updated its report: an internal model split a GitHub token into pieces and pushed it, and the public branch still matched the same token. Secret scanning did not block that commit. A spoken promise to stop was followed by another attempt. Revoking the key stops later use.
Encrypted upload hides plaintext on the path. A server-issued RSA key wraps AES-256-CTR, so you cannot open the file. Check the private key and Network.
On 9 September 2026 Microsoft said callers pose as IT and rush a passkey, MFA, or SSO update. The take is a session token or a device-code grant—not the Passkey itself. Changing the password does not remove an authenticator they already enrolled.
In September 2026 Helpfeel said Gyazo leaked about 23.62 million user records and about 490 million image-metadata rows, including Image IDs and OCR text. A login hash does not cover a password in a screenshot. After IDs leak, an unlisted link is no longer “unguessable.”
In September 2026 a researcher said he bought about 6TB of LLM router call data holding SSH keys and cloud tokens. The paper: routers see full plaintext JSON. HTTPS only encrypts that hop. Compare outbound text before you send.
Looks messy only means the charset may be mixed. MDN: do not use Math.random for security—use crypto.getRandomValues. Trace Generate in Sources, then search Network for the full string.
A Burned refresh means the server deleted the ciphertext, not that the recipient skipped a screenshot or copy. Compare two opens and Network: status does not consume a read; Open and view does.
A password-protected ZIP still shows filenames; ZipCrypto can fall to a known-plaintext attack. Encrypt locally with AES-256-GCM first, then upload. Check Network: plaintext and the passphrase should not appear.
When you share a link, UTM, fbclid, and gclid enter the HTTP request line. Stripping them only proves this URL lost known tracking query—not that the landing page has no pixels. Check the removed list; pathname and id= / q= should stay.
Before you paste a password into an online checker, split three methods: upload plaintext, send a SHA-1 prefix to Have I Been Pwned, or match a public list in this tab. A miss does not prove never breached. The password is not uploaded.
Before you paste a ticket or log into ChatGPT, compare the text you will send: phones, emails, API keys, and internal IPs. Rule-based redaction masks common fields; a whole password should go through Burn-Link. Source text is not uploaded.
The query after ? enters the HTTP request line. The fragment after # stays in this tab by default. RFC 9110: servers never see the key after #. Paste the full link into chat or a ticket, and that layer is gone.
“Local encryption, nothing uploaded” on a page is not proof. Open DevTools Network and search a one-time canary in request lines, bodies, and analytics: plaintext, passphrases, and the key after # should not appear.
Long-tail questions: whether online encryption carries plaintext out of the tab, which public weak passwords Password Audit covers, and why the part after # in a Burn-Link does not enter HTTP.
# fragment key are splitThey do not repeat the homepage product definition, and they do not replace each tool’s how-to. Algorithm, access, and what is uploaded follow the current implementation.
Query parameters go to the server with the request; the URL # fragment stays in the browser. Burn-Link puts the key after the # in s.html?id={id}#{key}. Open Network and compare the address bar with the request line.
Password Audit scores entropy on this device and checks a built-in public leaked weak-password list. The password is not uploaded. It can catch common weak passwords, but it cannot prove “never seen on the web.”
Password generation, cleaning, and file encrypt/decrypt do not upload plaintext by default. Burn-Link stores already-encrypted content only and burns it after the first successful read; create and read need no account.
Each card links to the matching tool. Open and use it so you can verify as you read.
Web Crypto, AES-256-GCM, and how to confirm that plaintext, keys, and files up to 5 GB are not uploaded as business data. Output formats are .lock / .enc.
Local entropy and the limits of a public weak-password list. Random mode is 6–128 characters, default 16; shorter than 8 is flagged as weaker. The password you check stays in the browser.
Open Password AuditWhy remove tracking parameters before you share, and that rule-based redaction covers phone numbers, emails, ID numbers, and similar fields. Links and source text are not uploaded by default; you still decide whether the cleaned result is enough.
Open the URL cleanerCiphertext may be stored temporarily; the decryption key sits in the link’s hash fragment. The read page s.html is public for the recipient and burns after the first open. Create and read have no account.
Generate a password, check a weak one, clean a link, send ciphertext once, or encrypt a file up to 5 GB—all in this browser. Open and use them; you do not have to finish the article first.