What this policy covers
MakePwd is a browser-first encryption and privacy tools site at makepwd.com. This policy explains where data is processed when you open a page, whether it leaves this device by default, and why we process information that does reach the server.
This page describes capabilities as they are implemented. We do not claim GDPR or other certifications, and we do not write “local-first” as absolute zero logs—ordinary website requests may still leave technical records.
We do not offer accounts
MakePwd has no user registration, sign-in, or password vault. You do not need an account to use every tool, including the Password Generator, Password Audit, Privacy Cleaner, Burn-Link, and File Encryption Box. Recipients also need no account to open a Burn-Link reader.
So we do not collect email, phone numbers, or identity details in order to “save your passwords” or “sync favorites.” The footer also does not show a support email.
What stays in the browser
The tools below run in this tab with browser capabilities (including the Web Crypto API). Matching plaintext, keys, or files are not uploaded by default.
| Tool | What stays on this device | Extra limits |
|---|---|---|
| Password Generator | Generated random characters or memorable passphrases | Length range 6–128 characters; you may copy or export to your device. The site does not store them for you |
| Password Audit | The password you type, the strength estimate, and the comparison against a built-in public leaked weak-password list | Not a web-wide HIBP check; the password you type is not sent to an external lookup API |
| Privacy Cleaner | URLs to clean, source text to redact, the strip list, and masked results | Source text is not written to analytics |
| File Encryption Box | Files, passphrases, derived keys, and encrypt or decrypt results | Algorithm is AES-256-GCM; one file up to 5 GB; .lock / .enc downloads to your device |
After you copy a result into chat, mail, or a drive, how it is stored and forwarded is under your control and outside this site’s processing.
What reaches the server
Besides the static pages and scripts themselves, the following mainly leave the browser today.
Burn-Link ciphertext
Only when you create a Burn-Link does the browser send already-encrypted ciphertext to the existing API, plus expiry and max reads. Plaintext and the AES decrypt key are not uploaded. See the next section.
Technical data when you open a page
When you visit any page, the network request travels hosting and transport links. Servers or CDN nodes can usually see the IP address, approximate time, request path, query parameters (for example the reader id), and browser type. URL # fragments do not enter the HTTP request under browser rules, so the decrypt key should not appear in access logs.
When you create a Burn-Link, the server rate-limits by IP to limit abuse, not to identify you.
Analytics
Outside a local preview environment, the page sends view and click events to the analytics endpoint deployed on this site. See “Analytics.”
How Burn-Link stores and destroys data
At create time, the browser encrypts the text on this device with AES-256-GCM, then sends ciphertext, expiry (ttl_hours, 0–168 hours, default 24), and max reads (max_reads, 1–10, default 1) to the server. The server returns an unguessable id, and the page writes the full link as s.html?id={id}#{key}.
The server should keep only ciphertext and the non-sensitive metadata above, such as created time, expiry, and read count. The server should not keep:
- Plaintext
- The decrypt key after
# - User accounts (this site has none)
After the recipient opens the full link, the reader fetches ciphertext with the query id and decrypts on this device with the fragment key. After the read count or expiry, the server deletes the ciphertext. Opening it again says it has been burned or has expired. A lost link cannot be recovered from this site, because we have no plaintext copy and no separately stored key.
The reader is a temporary ciphertext page and is marked noindex for search engines. Whoever receives the full link including # receives the ability to decrypt. Send it only to a recipient you trust, and avoid pasting the full link where it may be logged.
Cookies and local storage
This site does not use account cookies. Two kinds of local records may appear in the browser:
- Language preference: when you switch language, the current directory code is written to the browser’s localStorage so the root entry can remember your choice next time.
- Analytics cookies: the Matomo deploy on this site may set first-party cookies to distinguish visits and sessions. They are not used for sign-in and are not bound to a user account.
Passwords, passwords under test, source text for cleanup, file passphrases, and Burn-Link plaintext are not written to localStorage by default. You can clear cookies and site data in browser settings. After that, the language preference may return to the default (with no record, the root entry opens the English site).
Analytics
To learn which pages are opened and which buttons are used, this site deploys Matomo on its own path. Analytics requests go to this site, instead of handing tool source text to a third-party ad network.
Events contain only a page or action name, such as “Generate password,” “Clean link,” or “Burn-Link created.” We do not write the following to analytics:
- Generated passwords or passwords under test
- Privacy Cleaner URLs or source text
- File names, file contents, or encryption passphrases
- Burn-Link plaintext, ciphertext, or the
#key
Analytics is used to improve the site, not to show you personalized ads. Retention depends on that analytics service’s configuration. This policy does not promise a specific number of days.
Third parties and disclosure
Static assets and page scripts are provided by this site. React, Vue, and ad scripts are not added. The Burn-Link API is handled by this site’s backend for ciphertext storage. Hosting, DNS, or CDN operators may see the technical data in the previous section during transit.
We do not sell your tool input. We also do not give ciphertext or analytics to unrelated third parties except in the cases below:
- You send a Burn-Link to a recipient, who can then request the matching ciphertext and decrypt it on their device
- The law requires us to cooperate and we actually hold the relevant records (for example access logs or ciphertext that has not yet been burned)
Even if we are asked for Burn-Link records, the server side has only ciphertext and metadata, not the # key, so plaintext usually cannot be restored.
Children
These tools are for adult use cases such as generating passphrases, cleaning outbound content, or encrypting files. They are not aimed at children under fourteen. We do not actively collect children’s identity information. If you are a guardian and believe a minor uploaded content that should not have been shared to Burn-Link, stop circulating that link. After it is read or expires, the matching ciphertext should be deleted as designed.
Policy updates
If the tool set, analytics method, or ciphertext API changes, we will update this page and the effective date at the top. Continued use means you understand the updated description. Historical versions are not delivered as account notices, because this site has no account system.
How to contact us
No public support email is connected, and the footer does not show an unused support@ address. This page is the source for how data is processed. Use rules are in the Terms of Service.
FAQ
Do I need an account to use MakePwd?
No. MakePwd does not offer user accounts, sign-in, or a password vault. Every tool opens and can be used at once.
Are generated passwords, passwords under test, or files uploaded?
Not by default. Password generation, Password Audit, Privacy Cleaner, and File Encryption Box finish in this browser. Plaintext, keys, and files are not uploaded and are not written to analytics.
Can the Burn-Link server see plaintext?
No. The text is encrypted in the browser with AES-256-GCM first. The server stores only ciphertext plus expiry and read count. The decrypt key sits in the link’s # fragment and is not sent to the server with the HTTP request.
Does analytics record what I type?
No. Analytics records page views and button names such as “Generate password” or “Clean link.” It does not write passwords, file names, source text for cleanup, or Burn-Link plaintext.