Last updated: October 19, 2026
Passwords, passphrases and PINs
Everything you generate on this website and in the SuggestPassword Chrome extension is created locally on your device with your browser's cryptographically secure random number generator. It is never sent to us, stored or logged, and we have no way to see it.
The password strength checker
Passwords you type into the strength checker are analysed in your browser and never sent to us. If you click Check if it has leaked, your browser sends the first 5 characters of the password's SHA-1 hash to the Pwned Passwords service by Have I Been Pwned. That short prefix is shared by hundreds of other hashes and can't be turned back into your password; the comparison happens on your device.
The WiFi QR code generator
The network name, password and QR code are created in your browser and never sent anywhere.
What we log when you visit the website
Like most websites, our server records basic visit information: your IP address, an approximate country, the time of the visit and your browser's user agent. We use this to count visitors, spot abuse and keep the site running. We also use a first-party analytics script to count page views. We don't sell or share this data with advertisers.
Cookies
themeremembers whether you picked light or dark mode.- Our analytics script sets a cookie to tell new and returning visitors apart.
The API
Passwords requested from api.suggestpassword.com are generated for that request and returned straight away. They are not stored. Standard server logs (IP address, time and requested URL) are kept for abuse prevention.
The Chrome extension
The extension collects no data and makes no network requests. Your generator settings, and the list of sites where you turned suggestions off, are saved only in the extension's own storage on your device.
The right-click Generate strong password menu only runs on the page and field you right-clicked, at that moment. It fills in the password, copies it to your clipboard and does nothing else.
The optional Suggest on sign-up forms feature is off until you switch it on. Chrome then asks you to allow access to websites, which lets the extension notice when a page asks you to create a password and offer one. It only looks at the form on your own device, never reads or sends what you type, and only fills in a password when you click Use password. Switching it off removes the access again.
Contact
Questions about privacy? Send us a message.