nicelydone

Trust & transparency

Don’t trust us. Verify.

Every tool here is built so you can check exactly what leaves your browser — in about ten seconds, with tools you already have.

01

How the tools work

Every generator, checker and converter — passwords, hashes, Base64, JSON and the rest — runs entirely as JavaScript inside your browser. Nothing you type, paste or generate is sent anywhere, because there’s no server-side processing to send it to.

Verify it yourself, right now

  1. Open any tool, e.g. the Password Generator.
  2. Press F12 (or right-click → Inspect) and open the Network tab.
  3. Clear the log, then generate a few passwords.
  4. Watch the list stay empty: no fetch, no XHR, nothing leaves the page. You can even switch off Wi-Fi first — it keeps working.
02

What talks to a server

Vague privacy claims are how bad actors get away with lying, so here’s the precise list:

Pages, fonts and iconsOur server only — no third-party CDNs or font services
Password, passphrase & PIN generatorLocal only
Hash generator · Username generatorLocal only
Strength checker — leaked-password check5 hash characters to Have I Been Pwned (optional)
Base64 · JSON · Text case · Unit · Hijri dateLocal only
Subnet calculatorLocal only
Speed testOur server only — results stay in your browser; nothing logged
One-time secret linksOur server — encrypted ciphertext only, key never sent
Your public IP lookup (IP & Network page)Public IP service
Sign in · Sign up · ProfileOur server — only if you create an account

For the speed test, your IP address is held in memory — never on disk — for up to an hour, only to pace repeat tests fairly. It is not logged or linked to anything.

You never need an account to use any tool. There are no analytics, no advertising scripts and no tracking cookies; the only cookie is the sign-in session, and only if you sign in.

03

Open source

“Trust us” is a weak claim from a security tool. “Read the code” is a strong one — it’s the same reason open-source password managers earn trust. The full source is public:

github.com/AbdulazizAlwabel/passforge
Read every line, or fork it and run your own copy.
04

Connection security

The whole site — every page, the API and all assets — is served over HTTPS. Account passwords are hashed with bcrypt (cost 12) and never stored or logged in plain text; sessions use an HTTP-only, same-site cookie that page scripts can’t read; one-time email links are stored only as SHA-256 hashes and expire.

Randomness for every generator comes from crypto.getRandomValues with rejection sampling, so every character is equally likely.

05

Who built this

A

Built by a solo developer, not a company.

It started as a personal itch: most “free online tools” sites are ad-stuffed and vague about what they do with your input. I wanted a password generator I’d actually trust for my own accounts — so I built one, made the logic auditable, and put it up for anyone who wants the same thing. No funding, no data resale, no dark patterns. Just tools that do the one thing they say they do, nicely.

Passphrases use the EFF Short Wordlist (CC BY 3.0 US).