Privacy

Last updated: 26 August 2026

vault is built so there is almost nothing to say here, which is the point. It is a static website that runs entirely in your browser. There is no account system, no database, and no server that receives your inputs.

What we collect

Nothing. No cookies, no analytics, no tracking pixels, no fingerprinting. Passwords and passphrases you type or generate never leave your device and are never logged.

The one network request

The breach check uses k-anonymity. Your password is hashed with SHA-1 in your browser, and only the first five characters of that hash are sent to the Have I Been Pwned range API. That prefix cannot identify you or reconstruct your password. Nothing else is transmitted.

Third parties

Have I Been Pwned (haveibeenpwned.com) operates the range API used by the breach check and has its own privacy practices. The app loads no third-party scripts, fonts, or trackers.

Contact

Questions: security@0x6a03448f4d.com