Privacy policy
What the service collects, what it refuses to collect on principle, and what happens to whatever you type into the fields.
Updated 26.07.2026. This policy describes the site www.parolgen.ru and is written in plain language: legal boilerplate does not help anyone understand what happens to their data.
In short
Passwords, passphrases, PIN codes and everything else the site generates are created in your browser and never sent to the server. The site stores exactly one thing in browser storage: your chosen colour theme. The only data kept on the server belongs to draws you chose to publish yourself.
What is never collected
- Generated passwords and keys. Generation happens entirely in the browser using the cryptographic generator
crypto.getRandomValues. Not a single character reaches the server or survives closing the tab. - Passwords typed in for checking. The strength analyser computes everything locally. The breach check uses k-anonymity: only the first five characters of the SHA-1 leave your browser, and they cannot reveal what you checked.
- Lists you paste into the tools. Splitting into groups, the wheel of fortune and the quick winner pick all run in the browser and send nothing anywhere.
What is stored in your browser
One value: the colour theme you picked (light, dark or “follow the system”). Without it the theme would reset on every page. It is an interface setting, holds no personal data, is never sent to the server and disappears when you clear site data in your browser.
The list of recently generated passwords lives in tab memory and disappears when the tab closes: it is never written to persistent storage.
What is stored on the server
Traffic statistics. Every page view records the page address, the language, the device type and the domain you came from. The contents of input fields never enter the statistics.
To count unique visitors, the IP address and the browser string are turned into an irreversible fingerprint with a salt that changes every day. The IP address itself is not stored, and because the salt rotates, visits on different days cannot be linked. Fingerprints are deleted after 45 days, anonymised daily totals after six months.
Draws. When you create a public draw, the server stores the title, the conditions, the fingerprint of the participant list, the time and the result. The list itself is stored in full only if you ticked “show the participant list”; otherwise only its fingerprint remains. A draw by numbers has no list at all, only a range. Stored lists are deleted after 90 days; the result page lives for a year.
Do not paste phone numbers, addresses or anything else unnecessary into participant lists: a name or a profile link is enough for a draw.
Analytics
If the site owner has enabled an analytics counter, it collects anonymised statistics: pages, referrers, devices. The fields where passwords appear — the generator output, the history and the check field — are marked in the markup so their contents stay out of session recordings. You can verify this in the page source: such elements carry the ym-hide-content class.
We use third-party web analytics — primarily Yandex.Metrica, and possibly others over time. They exist so we can see which tools people use and what is worth improving.
Such services set their own cookies and receive anonymised details of the visit: page address, referrer, device and browser type, approximate location by IP address. Their owner, not us, defines how that data is processed; the terms are published in the documents of the service in question.
Important. The counters are also loaded on pages with input fields. If session recording is enabled in the analytics settings, field contents could in theory end up in those recordings. The site owner is advised either to disable session recording or to switch on the mode that keeps counters off tool pages.
You can opt out with browser tools: the “do not track” setting, a blocker extension, or by refusing third-party cookies. The built-in visit counter described above keeps working either way — it sets no cookies and passes data to nobody.
Advertising
If ad blocks are placed on the site, their code belongs to the ad network and may set its own cookies to serve ads. Ad blocks are never placed next to password input fields.
Accounts and mailings
There is no sign-up at the moment: every tool works without an account. If some services gain account-based access, that will require an email address, and this section will be extended before it goes live: we will describe exactly what is stored, how to unsubscribe and how to delete an account. Any mailing list will be opt-in with one-click unsubscribe.
Sharing with third parties
We do not sell or pass data to third parties beyond the cases described above: analytics and advertising services when installed, and the breach-check service, which receives five characters of a hash when you explicitly press the button.
Your rights
You can clear the site data in your browser (the theme setting goes with it), refuse cookies and use blockers. If you created a draw and want it removed ahead of schedule, write to us with the link.
Changes
If the set of collected data changes, we will update this page and the date at the top. Substantial changes — the arrival of sign-up, for example — will be described here before they go live.
How to reach us
Questions about data processing, deleting a draw you created or opting out of analytics go through the form below.