Your passwords never leave your device
No password goes to any server — not yours, not ours. Here’s everything we did to make that true, explained like you’re 6 and then for grown-ups, plus three ways to check for yourself.
- Made here Your password is created inside your own browser.
- Sent nowhere We have no server code that could receive it.
- Forgotten Refresh or close the tab and it’s gone.
Last updated October 13, 2026
The story of Mia and the Magic Dice
The whole idea in four pictures.
1 Mia needs a secret code Mia has a treasure chest. To lock it, she needs a secret code nobody can guess. 2 She rolls magic dice — at home She rolls her magic dice in her own bedroom, with the curtains closed. Only Mia sees the numbers. 3 She tells nobody Mia doesn’t shout it, post it or send it. The secret code never leaves her room. 4 Sneaky Fox can’t guess it Fox tries and tries, but there are far too many possible codes. The chest stays locked!
The story, in real life
- Mia’s bedroom Your device
- Magic dice Your browser’s secure random generator
- Tells nobody Nothing is sent to our server
- Sneaky Fox Hackers — who can only guess
Twelve ways we protect your passwords
Each one comes with a kid-friendly picture in words, and “grown-up details” underneath.
Made on your device
Your computer rolls the dice all by itself — like playing a game alone in your bedroom.
Grown-up details
Passwords are created by crypto.getRandomValues() inside your browser. The code is downloaded once, then runs locally in your device’s memory.
No server can receive it
Our house has no mailbox, so no letter can ever be delivered to us.
Grown-up details
boltipass.com is a static site: pre-built files on Cloudflare Pages. We run no API, database or server-side code, so there is no endpoint a password could be sent to.
Never in the web address
We never write your secret on the outside of the envelope where everyone can read it.
Grown-up details
Passwords are never put in URLs, query strings or page titles — so they can’t land in browser history, server logs or analytics reports.
Forgotten on refresh
It’s like drawing in the sand: the next wave washes it away.
Grown-up details
A password lives only in this tab’s memory. We never write it to cookies, localStorage, IndexedDB or any cache. Only harmless settings (like “length 20”) are remembered on your device.
Your browser is our bodyguard
We asked your browser to guard the door: “Don’t let this page talk to strangers.”
Grown-up details
A strict Content-Security-Policy tells your browser to refuse connections to anyone but boltipass.com — plus Google Analytics and Hotjar hosts, and only on builds where those are switched on. Even a bug couldn’t phone home elsewhere.
Works in airplane mode
If it works with no internet, it can’t be telling anyone anything!
Grown-up details
After your first visit a service worker keeps the whole site on your device, so the generator works fully offline. Switch off Wi-Fi and try it.
Truly fair randomness
A magic dice that doesn’t secretly like some numbers more than others.
Grown-up details
We use the browser’s cryptographically secure random generator — never Math.random() — and remove “modulo bias” by re-rolling the few values that would favour some characters.
Visitor counters can’t read passwords
Counting kids who enter the playground is not the same as hearing what they whisper.
Grown-up details
Google Analytics and Hotjar load only after you say yes — never if your browser sends Do Not Track or Global Privacy Control. We send them page views only. The password sits in a read-only, masked field marked for Hotjar suppression, and is never placed in an event, URL or title.
No outside helpers
We make our own sandwiches — no strangers in our kitchen.
Grown-up details
Fonts, icons and code are all served from boltipass.com. No ad networks, social buttons, public CDNs or third-party widgets are loaded.
No accounts, no emails
You don’t have to tell us your name to roll the dice.
Grown-up details
There is no sign-up or login, so we hold no emails, names or identities to leak.
Doors and windows locked
We lock the doors, close the curtains and turn off the camera.
Grown-up details
HTTPS only, no embedding in other sites (anti-clickjacking), no content-type sniffing, Referrer-Policy “same-origin” so other sites never learn where you came from, and a Permissions-Policy that switches off camera, microphone and location here.
You can look inside
You’re allowed to peek at the recipe any time.
Grown-up details
Every line of code that runs is delivered to your browser, so you can read it in DevTools — or watch the Network tab stay quiet while you generate.
Don’t trust us — test us
These three tests work on any password generator. Try them on Boltipass, then on any other one.
- Easy · 10 seconds
The airplane test
- Open Boltipass once while online.
- Turn on airplane mode (or switch off Wi-Fi).
- Press “New password” a few times.
It still works. A page that is offline can’t be sending anything anywhere.
- Medium · 30 seconds
The Network-tab test
- Press F12 (or right-click → Inspect) and open the Network tab.
- Click the 🚫 clear button, then press “New password” several times.
- Watch the list.
Nothing new appears. (If you allowed visit counters, you may see page-view pings — click one: it contains the page address, never a password.)
- Nerdy · 1 minute
The locks test
- Open DevTools → Elements and expand <head>.
- Find the <meta http-equiv="content-security-policy"> tag.
- Read the connect-src rule.
It lists only boltipass.com (and analytics hosts, if enabled). That’s the list of places your browser is allowed to talk to — and passwords aren’t sent to any of them.
About Google Analytics and Hotjar
We’d like to know which pages help people. So — only if you say yes — we use two common tools. Here’s exactly what that means.
Like you’re 6: imagine a clicker at the playground gate that counts how many kids come in, and a camera that sees which slide is most popular. It doesn’t hear what anyone whispers — and we’ve put a “Do not record” sticker on the secret-code box.
What they may see
- Which pages were viewed, and how you arrived (for example from a search).
- Rough location (country or city), device type, browser and screen size.
- Clicks, scrolling and the page layout — Hotjar can build heatmaps and replays of how people use the site.
What they never get
- The passwords, passphrases or PINs you generate.
- What is inside the password box (it is masked and excluded).
- Anything in a URL, page title or event — we never put your passwords there.
How we keep counters away from your passwords
- Off until you say yes — and never switched on if your browser sends Do Not Track or Global Privacy Control.
- Only “this page was viewed” is reported. We send no custom events.
- The password sits in a read-only, masked text field. Hotjar masks form fields by default, and we also mark the whole generator for Hotjar suppression.
- Passwords are never placed in a URL, page title or event, so nothing about them can reach a report.
- The “Recent” list shows dots, not text, and copies from memory when you press Copy.
- Your browser is told (via Content-Security-Policy) to talk only to boltipass.com and the analytics hosts that are switched on.
Being honest: any script you allow on a web page can, in principle, read what that page shows. That’s why counters are off by default, why the password is kept in a masked field, and why saying “No thanks” is always an option — the generator works exactly the same without them.
Your choices
- Say yes or no in the banner. You can change your mind any time with Privacy choices in the footer.
- Browsers that send Do Not Track or Global Privacy Control are treated as “no”, and never see a question.
- Our basis for using these tools is your consent, which you can withdraw whenever you like.
- Ad blockers and tracker blockers also work fine here.
Right now, visit counters are not switched on for this site, so nothing is loaded.
Cookies and other providers
Boltipass itself sets no cookies. If you allow visit counters, Google Analytics sets cookies named _ga and _ga_<ID>, and Hotjar sets cookies beginning with _hj; their lifetimes range from minutes to about two years. Those
companies handle data under their own policies: Google , Hotjar .
What stays on your device
The only things Boltipass ever keeps — all inside your browser, none of it a password.
| Name | What it is | Where |
|---|---|---|
bp_settings_v1 | Your generator settings (length, character types…) — never a password. | This device only |
bp_theme | Light or dark mode. | This device only |
bp_consent | Your yes/no about visit counters. | This device only |
Service worker cache | Copies of the site’s own files so it works offline. | This device only |
No accounts
There is no sign-up, so we hold no names, emails or profiles.
Hosting
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare handles routine request data (such as your IP address and the page you asked for) to deliver the site and block attacks. A password is never part of a request, so it can’t appear there.
Questions or requests
Email privacy@boltipass.com. We’ll answer in plain English. Boltipass is not meant for children under 13 to use alone, and we knowingly collect nothing about anyone.