Privacy Policy - LetaLab Passwords

Last updated: July 22, 2026

LetaLab Passwords (passwords.letalab.eu) is a small website that generates random passwords on the server and displays them to you. This page explains exactly what does and does not happen with your data when you use it.

Summary

The site does not use cookies, accounts, analytics, or any client-side tracking of any kind. It does not store anything in your browser either, nothing is written to local storage or any similar mechanism. The passwords it generates are created fresh for each request, sent to your browser once, and never written to a database, a file, or a log anywhere, at any point. The section below explains the one nuance worth being precise about: the web server itself keeps ordinary connection logs, the same way almost every website does, but those logs never contain the passwords you generate.

What is generated, and what happens to it

Each time you click "Generate new set," your browser sends a request to the server, which creates four random strings using your operating system's cryptographically secure random number generator, with rejection sampling so every character is chosen without bias. Those four strings are sent back to your browser in a single response and displayed on the page. The server does not keep a copy. Once the response is sent, nothing about the generated values remains anywhere on the server, they exist only in your browser from that point on, until you close or refresh the page.

What the web server logs, and what it does not

Like effectively every website on the internet, the web server that runs this site keeps standard connection logs: the requesting IP address, the time of the request, which page or endpoint was requested (for example POST /generate), and the browser's user agent string. This is ordinary web server behavior, used only for keeping the service running reliably and for spotting abuse, and it is not specific to this site.

What is not in those logs, and cannot be, is the content of what was generated. The web server's access log records that a request to /generate happened, never the four password strings that request produced. Those values only ever exist in server memory for the brief moment it takes to build the response, and are never written to disk in any form.

Rate limiting

To keep the service available for everyone, the server keeps a temporary, in-memory count of how many generation requests each IP address has made in the last minute, so it can slow down anyone sending an unreasonable number of requests. This count lives only in the running process's memory, is automatically discarded a short time after each address stops making requests, and is never written to disk.

Cookies and browser storage

This site sets no cookies and uses no browser storage of any kind (no local storage, session storage, or similar). There is nothing for it to read back on a later visit, because nothing is ever saved on your device in the first place.

Third parties

No analytics, advertising, or tracking scripts are loaded, and no fonts, scripts, or styles are pulled from anywhere other than this site itself. The page contains one plain outbound link, to Qualys SSL Labs, so you can independently verify this site's TLS configuration. It only loads if you click it, opens in a new tab, and carries no tracking parameters.

Security

The site is served exclusively over TLS 1.3 and TLS 1.2, with HSTS enabled, and sends a strict Content Security Policy that blocks loading scripts or styles from anywhere but itself. The source code is open for review, see the "Source code" link on the generator page. We welcome responsible security review, if you find a problem, please report it privately and with enough detail to reproduce it, via the contact below.

Children's privacy

This site is not directed at children and does not knowingly collect information from anyone, regardless of age, since it does not collect information at all.

Changes to this policy

If this site's data practices ever change, this page will be updated before the change takes effect, and the "Last updated" date above will be revised accordingly.

Contact

Questions about this policy, this site, or a security report can be sent via letalab.eu.