AccessBG Password Studio

Privacy Policy

Short version: the passwords you generate never leave your device. Passwords you choose to hash are sent to our own server over HTTPS, used once, and immediately discarded. We have no accounts, no cookies and no tracking of our own.

Last updated: 18 October 2026

1. Who we are

AccessBG Password Studio is a free web tool published at accessbg.eu. For any question about this policy or your data, contact privacy@accessbg.eu.

2. What we do not do

  • We do not require an account, e-mail address or any personal details to use the tool.
  • We do not use our own analytics, advertising pixels, social plug-ins or tracking cookies.
  • We do not store the passwords you generate, the passwords you hash, or the hashes you verify.
  • We do not sell or share data with third parties.

3. Passwords you generate

Passwords and passphrases are created entirely inside your browser using the Web Crypto API. They are not transmitted anywhere, and they are not written to browser storage. Closing the tab discards them.

4. Passwords you choose to hash

Argon2id and bcrypt hashing are computed by our server rather than in the browser. When you press Hash or Verify, the password you typed is sent to accessbg.eu over HTTPS (TLS 1.2/1.3), used to compute or compare the hash, and then discarded. Specifically:

  • It is never written to disk and never entered into a database.
  • It is never written to a log file: our application logs record only the HTTP method, path, status code, response size and duration.
  • It is never shared with a third party, and it is not used for any other purpose.

Our server does record, in memory only, the originating IP address of hashing requests for up to 10 minutes, solely to enforce rate limits and prevent abuse. It is not logged and not persisted. The legal basis for this short-lived processing is our legitimate interest in keeping the service available (GDPR Art. 6(1)(f)).

5. What is stored on your device

The site keeps a few small preferences in your browser's localStorage. None of them is a cookie, none is sent to us, and none ever contains a password:

  • accessbg:preferences — your generator settings (length, character sets, mode).
  • accessbg:theme — your choice of light or dark theme, and only if you pressed the toggle.
  • accessbg:consent — your answer in the consent banner (accepted or declined), and only once you have answered it.

You can delete all of them at any time from your browser settings, or reopen the banner with the "Cookie settings" link in the footer. The site then falls back to its defaults.

5a. The consent banner

The banner you may see near the footer asks for your decision before any advertising cookie could be used. It is not a cookie wall: declining is a single click, is exactly as prominent as accepting, and does not restrict any part of the tool. We store your answer on your device in localStorage, not in a cookie, so asking the question does not itself set anything that requires consent. You can change your answer at any time via "Cookie settings" in the footer.

6. Clipboard

Copying a password uses your browser's clipboard. If you use the auto-clear behaviour, the clipboard is emptied about 30 seconds after copying — and only if it still contains the password we copied, so later clipboard content is never overwritten.

7. Server logs and security

Requests are logged without client IP addresses, without headers and without request bodies, and those logs are not retained beyond routine operational need. The service applies strict security headers, rate limiting and request size limits. The application runs in a container as an unprivileged user.

8. If we display advertising

Advertising is not enabled on this site today. If we enable it, this section will apply, and we will update this page before doing so:

  • We may use Google AdSense. Google and its partners may use cookies and similar technologies to serve ads based on your prior visits to this or other websites.
  • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
  • You can opt out of personalised advertising in Google Ads Settings, and learn more in Google's advertising policies.
  • Visitors in the European Economic Area, the UK and Switzerland will be asked for consent before any advertising cookie is set, and can refuse without losing access to the tool.

9. Children

The service is not directed at children under 13, and we do not knowingly collect data from them.

10. Your rights

Because we do not build profiles and do not retain personal data, there is usually nothing to access, correct or erase. If you believe we hold personal data about you, write to privacy@accessbg.eu and we will respond within the periods set by the GDPR, including your right to complain to your national supervisory authority (in Bulgaria, the Commission for Personal Data Protection).

11. Changes to this policy

If this policy changes, the "last updated" date above will change with it. Material changes will be highlighted on the main page.

Generated locally. Never stored. Never logged. Back to the password generator.