Privacy Policy

The short version

Most tools on ToolsForCyber — hashing, encoding, decoding, generating, parsing, and calculating — run entirely as JavaScript in your own browser. What you type into those tools is never transmitted anywhere. A small number of tools have a specific, narrow reason to make a network request, listed exactly below. This site's own code sets no cookies of its own.

Requests from the shared site template, not any specific tool

• Google Fonts: every page on this site loads its typefaces from fonts.googleapis.com and fonts.gstatic.com, with no exceptions. Per Google's own Fonts Privacy FAQ, that request includes the visitor's IP address, the Google Fonts resource being requested, and normal HTTP request headers — the same information any web request inherently includes. Google's own technical documentation confirms the user-agent header specifically is used to serve a stylesheet tailored to that browser (e.g. different font file formats for different browsers), not for tracking. Google's own FAQ also states the Fonts API does not set or log cookies.
• Google Tag Manager loader: pages where tracking is not explicitly disabled load Google Tag Manager's own loader script from googletagmanager.com — a real request to Google's infrastructure, regardless of whether a specific tag is configured inside that container. Some privacy-sensitive tool pages disable it entirely (see Analytics below for the specific list). See that same section for what loading the loader does and doesn't mean in this specific build.

Where a network request genuinely happens

• DNS Record Lookup: the domain name you enter is sent to whichever public DNS-over-HTTPS resolver you select (Cloudflare's 1.1.1.1 or Google's 8.8.8.8) so it can be resolved — that's the tool's entire purpose. No other tool input is intentionally included in that query. As with any HTTPS request, the resolver can see standard connection metadata such as the requesting IP address — Google's own Public DNS documentation describes exactly this about its own service.
• What's My IP: your public IP address is visible to this site's own server the same way it's visible to any web server you connect to — that part requires no separate lookup. Two further lookups are separate, optional steps, each requiring you to click a button before it runs: geolocating that IP (city/region/country) sends it to a third-party GeoIP service (freeipapi.com); looking up its reverse DNS (PTR) hostname sends it to the same Cloudflare DoH resolver the DNS Lookup tool uses.
• Password + Breach Checker: checking a password's strength happens entirely locally and is never sent anywhere. Checking whether a password has appeared in a known breach sends only the first five characters of that password's SHA-1 hash to HaveIBeenPwned's k-anonymity API in the request URL — never the password itself, and not even the full hash. As with any HTTPS request, that connection still exposes standard connection metadata (such as the requesting IP address) to HaveIBeenPwned, the same way it would to any server.

A direct search of this site's own code found no other network request tied to what you type into any tool.

Server logs

This is a standard PHP/web server setup, and web servers of this kind typically log basic request information (such as IP address, requested URL, and timestamp) as part of normal infrastructure operation — for things like diagnosing errors and detecting abuse. That's typical of web hosting generally, not a detail specific to any tool's own logic. Separately, this site's own code includes a small amount of its own error logging (via PHP's standard error_log()), used specifically to record operational failures in the infrastructure that determines a visitor's real IP address behind Cloudflare — things like a corrupted local cache file or a failed write — not visitor IP addresses, tool input, or any other personal data.

Newsletter signup

The email signup form in this site's footer requires confirmation before it does anything: submitting your address doesn't subscribe you immediately — it sends a confirmation email with a link, valid for 24 hours, that you have to click to actually complete the subscription. This is meant to prevent someone else typing your address in by mistake (or on purpose) from subscribing you without your consent.

Your address is stored in this site's own self-hosted MariaDB database — not a third-party email marketing service. Retention depends on the state of the subscription specifically:

• Unconfirmed (pending): if the confirmation link is never clicked, the signup attempt is deleted automatically 30 days after that link expires — it never became a real subscription and isn't kept indefinitely.
• Subscribed: the record is kept for as long as you remain subscribed, or until you request deletion (see the FAQ below).
• Unsubscribed: the record itself is kept even after you unsubscribe, rather than deleted automatically — specifically so that re-submitting that same address later requires a fresh confirmation click again, rather than silently reactivating without your consent, and so there's a minimal record of when you subscribed and unsubscribed. You can still request the record be deleted outright at any point; see the FAQ below.

Separately from the subscription record itself, every signup attempt — the IP address it came from and the email address typed in, whether or not that address ever became a real subscriber — is logged for up to 90 days specifically to detect and rate-limit abuse (e.g. someone repeatedly targeting one address, or hammering the signup form). This log is deleted automatically after 90 days and is distinct from, and unrelated to, however long the subscription record itself is retained under the rules above.

The IP address a signup or confirmation came from is kept for abuse-prevention purposes and anonymized (removed) automatically after 365 days — separately from, and regardless of, how long the subscription record itself is retained under the rules above. Every subscription generates a unique, random unsubscribe link that works without needing an account or password, and requires an explicit click to confirm — a plain visit to the link (e.g. from an automated email-security scanner) doesn't unsubscribe you by itself; the same is true of the confirmation link itself. Unlike the one-time confirmation link (which becomes unusable immediately after you click it), the unsubscribe link's own token is retained in a form the site can reference again for as long as you're subscribed — specifically so it can be included in future emails, and so it can be given to you again on request (see the FAQ below) without needing to reset your subscription. The address is never sold or shared with anyone else. No newsletter has actually been sent yet in this build — this section describes the real storage, confirmation, and retention mechanics already in place, not a claim that emails are currently going out.

Contact form

The Contact page's form stores what you submit (name, email address, subject if given, and your message) in the same self-hosted MariaDB database, along with the submission's IP address for abuse-prevention purposes; the IP is anonymized (removed) automatically after 365 days. It's used solely to respond to your message and isn't added to the newsletter or shared with anyone else. There's currently no fixed deletion schedule for the message content itself; you can request deletion of a specific message via the process below.

Analytics

Google Tag Manager and Google Analytics are not the same thing, and this section keeps them separate deliberately. The shared site template loads the Google Tag Manager container loader on pages where tracking has not been explicitly disabled — a real request to Google's Tag Manager infrastructure, described above. Eight tool pages (Base64, CVSS Calculator, Epoch Converter, Hash Generator, JWT Decoder, Regex Tester, User-Agent Parser, and UUID Generator) explicitly disable it entirely at the time of writing. A real container ID is configured, but this codebase itself has no visibility into which specific tags (analytics or otherwise) exist inside that container — tag configuration is managed separately, in Google's own Tag Manager dashboard, not in any file here. Google's own documentation states Tag Manager keeps standard HTTP logs and deletes them within about 14 days.

Scope of this page

This page describes, in specific technical detail, what data this site's own code actually sends, stores, and logs. It is not written as a legally complete privacy policy for every jurisdiction. Depending on where you are and how the site is used, additional disclosures may apply — for example, the EU's GDPR requires specific information under Article 13 (such as the controller's identity and contact details, the legal basis for processing, and data subject rights), and the US's CCPA imposes its own disclosure requirements for sites that meet its specific applicability criteria. This page aims to be technically accurate about what happens; it does not by itself represent a legal compliance determination for any particular jurisdiction.

Frequently asked questions

Last reviewed: September 7, 2026.