Privacy

What your browser sends to WPSalt

WPSalt does not receive, store, log, or transmit passwords, candidate passwords, password hashes, or generated WordPress secret keys. Those values are processed with JavaScript running in your browser.

Network requests

When you load a WPSalt page, your browser requests the HTML, CSS, JavaScript, favicon, and — when needed — the bcrypt worker script from wpsalt.com. The site makes no analytics, advertising, font-provider, or other third-party requests. Password fields are never included in a URL or in a network request made by the application.

Hosting logs and your responsibility

Like most websites, the hosting layer may retain standard request metadata such as IP address, timestamp, requested path, and user agent. Do not put secrets in URLs. Keep generated wp-config.php keys private, and use authorized offline tooling for production credentials whenever possible.

Open source

You can inspect the implementation at github.com/CommanderWaterford/wpsalt.com. The code is the clearest account of what this site does in the browser.