Privacy

What your browser sends to WPSalt

WPSalt’s application code processes passwords, candidate passwords, password hashes, and generated WordPress secret keys with JavaScript running in your browser. It does not deliberately put those values in URLs, analytics properties, or requests made by the application.

Network requests

When you load a WPSalt page, your browser requests the HTML, CSS, JavaScript, favicon, and — when needed — the bcrypt worker script from wpsalt.com. There are no advertising or font-provider requests.

Analytics request

Every WPSalt page also loads Ahrefs Web Analytics from analytics.ahrefs.com. Ahrefs records aggregated traffic and standard interaction events. Its documentation describes page URL, referrer, user-agent-derived device data, country or city, browser language, link clicks, and form submissions; Ahrefs says the service uses no cookies or persistent identifiers by default. Read Ahrefs’ Web Analytics overview for its current handling details.

Because the tools handle sensitive values, use throwaway credentials whenever that is practical and do not enter an active production password unless you understand and accept Ahrefs’ privacy practices. Generated values remain in the page unless you choose to copy them.

Hosting logs and your responsibility

Like most websites, the hosting layer may retain standard request metadata such as IP address, timestamp, requested path, and user agent. Do not put secrets in URLs. Keep generated wp-config.php keys private, and use authorized offline tooling for production credentials whenever possible.

Open source

You can inspect the implementation at github.com/CommanderWaterford/wpsalt.com. The code is the clearest account of what this site does in the browser.