Security and Local Processing

Technical measures and limits

Password and UUID generation use the Web Crypto secure random API; security-sensitive random generation does not use Math.random(). Hashing uses the browser Web Crypto API. Inputs and generated passwords are not sent to a password or hash service, and generated passwords are not stored by the application. Some tools use browser APIs, workers, or locally loaded WASM.

Local processing is not a guarantee against a compromised device or hostile browser extension. Clipboard contents may be visible to other software on your system. Decoding a JWT does not verify its signature or claims. A hash is not encryption. Review the tool output and your browser’s security before using sensitive material.