This page explains what data FastPwd (fastpwd.com) actually processes, and answers whether passwords are uploaded. The online password generator, password strength checker, UTM stripper, text redaction, and file encryption all run in the browser. Plaintext, keys, and files are not uploaded by default. Burn-Link stores encrypted ciphertext only. To verify where computation happens, see Security.
The browser Web Crypto API or local scripts handle this content. It is not sent to FastPwd as the body of a business request.
Aside from ordinary page visits, FastPwd receives business data only for Burn-Link, and only as ciphertext.
FastPwd is a browser-local-first encryption and privacy toolkit. Open any tool page and use it—no signup. We do not create user accounts and do not offer a vault or favorites, so there is no “personal profile you can only see after login.”
This policy answers two questions: which sensitive computation stays on your device; and when the FastPwd server receives data, what it receives, and how long it is kept. To verify computation location on the spot, see Security. To clean links or text before sending them out, use the privacy cleaner.
Using this site means you understand the processing described below. If you do not agree, stop using features that need the network. Purely static tool pages can still be opened locally, but Burn-Link cannot be created or read. For conditions of use, responsibility, and prohibited uses, see the Terms of Service.
The tools below finish their computation in the current tab. Plaintext, keys, files, and source text you clean are not sent as HTTP requests by default and are not written to analytics.
| Tool | Processed locally | Not uploaded |
|---|---|---|
| Password generator | Random characters or a readable passphrase, 6–128 characters | Generated results; not persisted on the server |
| Password Audit | Local entropy assessment, compared with a built-in public leaked weak-password list | The password you test. This is not a full-web lookup and does not query an external breach API |
| Privacy cleaner | Strip tracking parameters; mask phone numbers, ID numbers, emails, and similar fields | Original links and source text, and they are not written to analytics |
| File Encryption Box | AES-256-GCM streaming encrypt/decrypt, one file up to 5 GB, output .lock / .enc | The file, passphrase, and original filename |
Encryption uses the browser’s built-in Web Crypto API with AES-256-GCM. After you close the tab, that input is not left on the FastPwd server—because it never arrived there as business data.
Burn-Link is the only tool on this site that sends business data to the server. Creating and reading do not require an account. A recipient opens the link with a complete # fragment and decrypts on this device.
Text is first encrypted in the browser with AES-256-GCM. The request then carries only ciphertext, a time-to-live in hours, and a read-count limit. Plaintext is limited to 32 KB per item. The server stores a ciphertext ID, the ciphertext itself, created time, expiry, the read-count limit, and how many times it has been read.
The decryption key is appended after # in the address, in the form s.html?id={id}#{key}. Browsers do not put the # fragment into the HTTP request, and it does not appear in access logs. The server therefore cannot turn the ciphertext back into plaintext.
The create API reads the request source IP for short-term rate limiting, to stop bulk writes. Rate limiting is only for abuse protection and is not used to build a user profile.
Production uses self-hosted Matomo and collects visits through this site’s /tj/ path. Local preview (localhost) does not load the analytics script. Analytics is used to see which pages are opened and which buttons are clicked, not to identify who you are.
We record page views and content-free action events, such as “Generate password,” “Copy result,” “Clean links,” “Create Burn-Link,” and “Switch language.” Event names describe the action. They do not carry passwords, keys, files, source text you clean, or Burn-Link plaintext.
Matomo may set a first-party cookie to distinguish visit sessions, and it processes ordinary visit fields such as page path, referrer, device type, and approximate region. We have not turned those cookies off. You can block or clear them in the browser; that does not stop the tools from running locally.
Analytics requests still pass through the server, so an IP and User-Agent may be visible. That does not conflict with “plaintext not uploaded”: sensitive body text does not enter event parameters.
Language switching writes your preference to this browser’s localStorage (key passafer_lang, plus a compatibility key). It only affects which language directory opens next time. It does not contain passwords or files.
Password Audit input is not written to local storage. File Encryption Box plaintext and passphrases likewise exist only in the current page session. Clearing site data removes the language preference.
Page fonts load from Google Fonts. That party may see your IP, browser, and the requested font weights. Beyond that, tool pages do not load ad networks and do not send plaintext to an external analytics or breach-lookup API.
The Burn-Link ciphertext API is hosted by FastPwd. Analytics is also self-hosted Matomo, not page events sent to a third-party analytics platform.
Because there are no accounts, we cannot search or export a data package under a “username.” The main business object that can be deleted is ciphertext that has not burned yet—and it disappears on its own after the read count or expiry.
# through a channel that strips fragments or writes them to logs.FastPwd does not publish a support inbox. Policy changes are written on this page with an updated revision date. No email goes out—there are no accounts, so there is no address to contact.
If the processing scope changes—for example a new feature that reports content—we will revise this page and update the “Last revised” date. Continued use means you understand the data boundary as the text then stands.
This policy only describes how FastPwd itself handles data. When you send a generated password, cleaned text, or a Burn-Link to a third party, how they store it is outside this policy.
No. Password generation and Password Audit both finish in the current tab. Generated results, passwords you test, and the built-in leaked weak-password list are not uploaded as business data and are not written to analytics.
No. Text is encrypted in the browser with AES-256-GCM. The server only stores ciphertext, a time-to-live, and a read limit. The decryption key sits in the link’s # fragment and never enters the HTTP request.
No. Self-hosted Matomo records page views and action event names only, such as “Copy password” or “Clean links.” Plaintext, keys, passwords you test, file contents, and source text you clean are not written to analytics.
No. Every tool is ready to use. This site does not offer signup, login, or a vault, so there is no account record to look up or delete.