Privacy

WoolKey was designed around a single principle: your passwords are yours alone.

What we collect

Nothing. WoolKey has no database, no user accounts, and no analytics.

Local generation only

Every password and passphrase you generate on this website is generated entirely inside your browser using the Web Crypto API. The generated values never leave your device — not to our servers, not to any third party, not anywhere.

The separate, opt-in HTTP API for scripts and AI agents is the one exception, and only for those who deliberately use it: there, generation happens on the server because that is what the caller asked for. Even then nothing is retained — the value is returned and forgotten, with no database and no record of what was generated. Using this website never touches that endpoint.

No storage

WoolKey does not store generated passwords in:

• localStorage
• sessionStorage
• IndexedDB
• Cookies
• URLs
• Server logs

When you close or navigate away from the page, the generated password is gone.

No external resources

WoolKey loads no external scripts, fonts, stylesheets, analytics, or tracking pixels. The Content Security Policy enforces connect-src 'none', which means the browser cannot make any outbound network connections from WoolKey's JavaScript.

Service worker

WoolKey includes a service worker for offline support. It caches only static assets (HTML, CSS, JavaScript, the word list). Generated passwords are never cached.

Server logs

Your web server (Apache) may record standard HTTP access logs including your IP address and the pages you visit. These are standard server-level logs and are not related to password generation.

Contact

Questions? CoolerSheep