Tool pages answer how to generate a password, run Password Audit, or encrypt a file right now. These notes cover where browser-local encryption runs, whether plaintext leaves the tab by default, and how you can verify that in DevTools. Open and read—no inbox required first.
Title and excerpt match the article. Open and read—no account.
“Local encryption, nothing uploaded” on a page is not proof. Open DevTools Network and search a one-time canary in request lines, bodies, and analytics: plaintext, passphrases, and the key after # should not appear.
Long-tail questions: whether online encryption carries plaintext out of the tab, which public weak passwords Password Audit covers, and why the part after # in a Burn-Link does not enter HTTP.
# fragment key are splitThey do not repeat the homepage product definition, and they do not replace each tool’s how-to. Algorithm, access, and what is uploaded follow the current implementation.
Query parameters go to the server with the request; the URL # fragment stays in the browser. Burn-Link puts the key after the # in s.html?id={id}#{key}. Open Network and compare the address bar with the request line.
Password Audit scores entropy on this device and checks a built-in public leaked weak-password list. The password is not uploaded. It can catch common weak passwords, but it cannot prove “never seen on the web.”
Password generation, cleaning, and file encrypt/decrypt do not upload plaintext by default. Burn-Link stores already-encrypted content only and burns it after the first successful read; create and read need no account.
Each card links to the matching tool. Open and use it so you can verify as you read.
Web Crypto, AES-256-GCM, and how to confirm that plaintext, keys, and files up to 5 GB are not uploaded as business data. Output formats are .lock / .enc.
Local entropy and the limits of a public weak-password list. Random mode is 6–128 characters, default 16; shorter than 8 is flagged as weaker. The password you check stays in the browser.
Open Password AuditWhy strip tracking parameters before you send, and that rule-based redaction covers phone numbers, emails, ID numbers, and similar fields. Links and source text are not uploaded by default; you still decide whether the cleaned result is enough.
Open privacy cleanerCiphertext may be stored temporarily; the decryption key sits in the link’s hash fragment. The read page s.html is public for the recipient and burns after the first open. Create and read have no account.
Generate a password, check a weak one, clean a link, send ciphertext once, or encrypt a file up to 5 GB—all in this browser. Open and use them; you do not have to finish the article first.