Privacy

Short version: what you generate or type here stays in your browser. ProtemKey has no accounts, sets no cookies, runs no analytics and loads nothing from any other site.

Passwords you generate or check

• Generated in your browser. Passphrases, passwords and PINs are made by JavaScript running on your device, using your browser's own random number generator. They are never sent to protemkey.com or anywhere else, and never stored.
• The strength checker analyzes what you type on your device. It is not sent, logged or saved; reloading or closing the page clears it.
• Enforced, not just promised. Every page is served with a Content Security Policy that includes connect-src 'self': the page's scripts may only fetch from protemkey.com, and the browser blocks any attempt to contact another site. The only things the scripts fetch are the site's own files (the word lists). You can confirm this in your browser's developer tools.
• No breach-lookup calls. The checker does not check passwords against online breach databases, because that would mean contacting a third party. How k-anonymity breach checks work explains how such services can be used safely elsewhere.
• Copying. The Copy button puts the secret on your device's clipboard, which other apps on your device can read until something else is copied. ProtemKey can't clear it for you.
• Your settings. The generators remember your last options (word count, separator and so on, never the secrets themselves) in your browser's local storage, so they are the same next time. Clearing the site's data removes them.

What ProtemKey stores

No cookies, no analytics scripts, no ads, no third-party scripts, fonts or images: every file comes from protemkey.com. If this ever changes, for example if advertising is added, this page will say so before it happens.

Server logs

Like almost every website, the server keeps a log of requests: the time, the page requested, the referring page, the browser's user-agent string, and a shortened network address (the last part of the IP address is removed before anything is written, so the log cannot point to one connection). The log is used only to count visits and to stop abuse, is never shared or sold, and is deleted after 30 days. The legal basis under the GDPR is legitimate interest in running and securing the site. Nothing you generate or type is ever in a request, so it is never in the log.

The hosting proxy in front of this site (measured 2026-10-26): successful requests are not logged there. Requests that fail at the proxy are recorded with the visitor's IP address and browser user-agent, with cookies and authorization headers redacted, and are currently kept until the proxy is restarted. A retention limit for those records is under review.

Offline

A small service worker keeps copies of ProtemKey's own pages and scripts on your device so the generators work without a connection. It stores site files only, never anything you generate or type.

Your rights

ProtemKey holds no account or profile about you. Server logs hold only shortened addresses and are deleted after 30 days.