01 / Security

FastPwd Security
Does plaintext leave the browser

The online password generator, password strength checker, UTM stripper, and file encryption all finish in the current tab: plaintext, keys, and files are not uploaded by default. Burn-Link stores ciphertext only; the decryption key sits after # in the address bar. This page states the boundaries you can verify on the spot; it does not replace retention periods in the Privacy Policy.

Browser encryption AES-256-GCM Plaintext not uploaded Verifiable on the spot

01

Stays on this device by default

These are handled by browser Web Crypto or local scripts. They are not sent to FastPwd as a business request body and are not written to analytics.

  • Random strong passwords and memorable passphrases drawn by the online password generator
  • The password you type into the password strength checker
  • Links before cleaning, and source text before redaction
  • Files, passphrases, and original filenames in File Encryption Box
  • Burn-Link plaintext, and the decryption key after #

02

Reaches the server

Aside from loading the page itself, FastPwd receives business data only for Burn-Link, and only as ciphertext.

  • Burn-Link: ciphertext, time-to-live, and a read-count limit
  • The create API uses the source IP for short-term rate limiting
  • Self-hosted analytics: page paths and action event names, not the text you typed
  • Language preference is stored only in your own browser local storage
02 / Check by tool

Where each of the five tools computes

The online password generator draws characters or words on this device with Web Crypto getRandomValues, not Math.random(). Length is 6–128 characters, default 16. Results are not stored; after you refresh, those plaintext strings will not appear on the server.

The password strength checker estimates entropy and crack time on this device and checks a public weak-password list shipped with the page. The password is not uploaded, and this is not a Have I Been Pwned-style full-web lookup.

The privacy cleaner strips UTM, fbclid, gclid, and similar trackers on this device, and masks phone numbers, emails, and ID numbers. Links and source text are not uploaded. The File Encryption Box uses streaming AES-256-GCM encryption; a single file may be up to 5 GB. The file and passphrase do not leave the browser.

Burn-Link is the only feature that sends content: text is encrypted on this device first, and the server stores ciphertext only. The key form is s.html?id={id}#{key}; the query string contains only the ID.

03 / How to verify

Do not stop at the slogan—look at this request

“Local encryption, not uploaded” is not evidence by itself. What you can see on the spot is which requests this tab sent, and whether the request body contains what you just typed.

01

Open Network

Search request lines and bodies for a string that appears only in this test. The generated password, the password you audited, cleaned source text, the file name, and the key after # should not appear.

02

Look at analytics requests separately

The page still loads styles and fonts, and may send analytics without the body text. Event names may appear; the plaintext you just typed should not appear in the query or body.

03

When you need step-by-step screenshots

The blog has a repeatable canary walkthrough, including Preserve log, a retest with the network off, and that a question mark enters HTTP while a hash does not by default. See How to verify browser-local encryption.

04 / What we cannot do

The boundary this page can promise stops here

Security answers “where computation happens and what is not uploaded.” The following are outside this page’s promises.

Cannot stop screenshots on the other side

Burn-Link reduces the risk of a link being opened repeatedly, and of the server keeping plaintext long-term. The recipient can still copy, take screenshots, or forward.

A forgotten passphrase cannot be recovered

The File Encryption Box passphrase derives the key only on this device. FastPwd has no copy and no recovery path.

Not a full-web breach lookup

The password strength checker compares against a public high-frequency weak-password list. It can catch common weak passwords; it cannot prove a string never appeared in any dump.

We do not inspect your browser extensions

A Network check cannot prove whether an extension read the clipboard. After you switch browsers or versions, run the canary search again.

[ 05 ] FAQ

The boundaries people ask about for online-tool safety

Password generation, strength checks, link cleaning, text redaction, and file encrypt/decrypt all finish in the current tab. Generated results, passwords you audit, source text you clean, files, and passphrases are not uploaded as business data by default. Burn-Link is the only feature that sends content; the server receives ciphertext only.
Open DevTools Network and search request lines and bodies for a string that appears only in this test. Plaintext, passphrases, and the key after the hash should not appear. Full steps are in How to verify browser-local encryption.
Plaintext is first encrypted on this device with AES-256-GCM, then only ciphertext is uploaded. The decryption key sits after # in the address bar and never enters the HTTP request. The server cannot see the plaintext or decrypt the ciphertext.
This page answers whether plaintext leaves the browser, where each tool computes, and what you can verify on the spot. The Privacy Policy covers what the server actually receives and how long it is kept. The About page explains who FastPwd is and why there is no password vault.
[ 06 ] Verify on the spot
Open and use →

First generate a set of random passwords on this device, or encrypt a disposable small file. Open developer tools and confirm the requests do not contain what you just typed.

→ Open the online password generator ↗ File Encryption Box Read the verification notes