Longer questions live here: whether “encrypt online” uploads plaintext, what a password strength check can prove, and why a key after # does not enter HTTP. This is not a product pitch, and it does not replace each tool’s instructions.
Each card’s title and summary match the article. Topics without a detail page do not appear here.
Email a password and it hits Sent and Inbox. STARTTLS is hop-only. Gmail Trash ~30 days; Exchange Recoverable Items default 14. Vault can still search. Check Sent. Use Burn-Link. No account.
A passworded ZIP is not a locked box. PKWARE calls ZipCrypto weak. Filenames and unencrypted entries stay in the clear. Check Method with 7z l -slt. No account.
Save Password is not this-PC-only. Google holds the decrypt key in the account by default (on-device encryption and a sync passphrase are two other switches). Chrome, Edge, and Firefox write an exported CSV as unprotected readable text. Test the other device and Downloads with a canary. No account.
Press Win+V or the signed-in phone: copying a password is not a one-window handoff. Windows history keeps 25 items (4 MB; restart clears except pins; cloud TTL up to 12 hours). Universal Clipboard reaches nearby Apple devices. Manager timers clear only this PC. Test with a canary. No account.
Default cloud encryption leaves keys with the provider. Instant upload hashes content; previews need plaintext. Encrypt locally to .lock first. No account.
Paste an API key into ChatGPT and it hits history. Off training does not erase chats. Temporary Chat can still sit 30 days. Memory, Library, and share links are extra copies. Mask locally first; revoke real keys.
Support tickets leak phones, SSNs, cards, and keys into logs. Rules catch six fields; names and spoken digits slip through. Masking is not anonymization. Opens with no account.
Burn-after-read is not “the URL is still there, so the secret is.” After a confirm fetch, ciphertext is deleted and the same id returns 410. The key stays after #. Chat unfurl can spend the only read. Create and read open with no account.
Ads leave utm_source, fbclid, and gclid in the address bar. Paste that URL into Slack or a ticket: the query hits history, logs, and Referer. Path and id stay.
A miss means this local frequent-password list did not match—not that it never leaked. Compare NIST’s blocklist with HIBP hash-prefix lookup. Nothing uploaded.
Queries go over HTTP; fragments after # stay in the tab. RFC 9110: servers never see the key. Paste the full link into chat or a ticket, and that layer is gone. Compare the address bar with Network.
A slogan is not proof. Open DevTools Network and search for plaintext, passphrases, or the key after the hash. Queries go over HTTP; fragments usually do not.
These directions serve developers, operators, and anyone who handles secrets on a device. They are themes, not unpublished article titles.
Web Crypto, AES-256-GCM, and how to confirm in DevTools that plaintext, keys, and files were never uploaded.
Open File Encryption BoxWhat local entropy and a public weak-password list can do, and what they cannot prove. This is not written as a web-wide breach lookup.
Open Password AuditWhy strip tracking parameters before you send a link, which fields rule-based redaction covers, and why you still decide whether the result is enough.
Open Privacy CleanerCiphertext is stored briefly and burned after reading, and why s.html?id= is split from the # key. The reader is public for the recipient.
No. Tool pages answer how to finish one task now. The blog covers principles, limits, and checks you can repeat. Articles are not rewritten as generator or checker manuals.
No. MakePwd has no accounts and no password vault. The blog and every tool are free to open.
We try to write repeatable steps, such as whether plaintext appears in Network, or whether a # fragment enters HTTP. Articles do not invent SLAs, prices, or a support inbox that is not connected.
Yes. The list only shows articles that already have a detail page, and titles and summaries match the body. The twelve pieces cover how to verify browser encryption in DevTools, why a URL # fragment is a fit place for a key, what a local weak-password list can prove, what tracking data rides along when you paste a UTM URL into chat, what remains on the server after a one-time secret is read once, what rule-based redaction can hide in a ticket—and what it still leaves behind, what remains after you paste a password or API key into ChatGPT, what a cloud provider, sync client, and content hash can still see after you upload an unencrypted file, what clipboard history and cloud sync can still hold after you copy a password, what cloud sync and a CSV export can still hold after you save a password in the browser, what default ZipCrypto, filenames, and unencrypted entries still leave after you send a password-protected ZIP, and what Sent, backups, and mailbox admins still keep after you email a one-time password.
Password generation, strength checks, cleanup, one-time secrets, and file encryption all finish in this browser. No account required.
Open Password Generator