How do I check on the spot whether plaintext was uploaded?

Open the developer tools Network panel, generate, audit, clean, encrypt, or create a link, then inspect the request body. A local tool should not contain what you just typed. Burn-Link should have only ciphertext, a TTL in hours, and a read count.

Can the UsePwd server unlock a Burn-Link?

No. Encryption finishes in the current tab with AES-256-GCM. The key sits only after # in s.html?id={id}#{key}. The browser does not put it in the HTTP request. Without that key, the server cannot decrypt for you.

Does analytics record what I type?

No. Self-hosted Matomo only records page views and the category and name of button actions, such as “Copy password” or “Create link.” It does not write generated passwords, test secrets, cleanup source text, file contents, or Burn-Link plaintext. Local previews do not send analytics.

Is it still safe if the device is compromised or an extension can read the page?

This page’s promise is: sensitive computation stays in the current tab, and plaintext is not sent to UsePwd as a request body by default. If the device is already controlled, an extension can read the page, or you copy the result to an untrusted channel, no web tool can promise safety. That is outside what this site can check.

Support / Security

Does plaintext leave the browser?

This page answers one question: whether what you type or generate on UsePwd leaves the browser as a request body. The password generator, strength checker, URL cleaner, and file encryption finish in this tab with Web Crypto. Burn-Link only hands ciphertext to the server; the key is appended after #. Below: where computation runs, and how to verify it in the Network panel.

Runs locally Verify in DevTools No accounts

01 / Conclusion

Separate what stays from what is sent

Opening any web page produces HTTPS access records. That is not the plaintext you typed in a tool. This page splits “what stays” from “what is sent,” so a slogan is not read as a server promise.

Stays in the current tab

Passwords and audit results Generated passwords, test secrets, strength grades, and built-in leaked-list matches are not sent as a request body.
Cleanup source and files Pasted links, text before and after redaction, file passphrases, and files up to 5 GB are handled only on this device. The server also never receives file ciphertext.
Burn-Link plaintext and key Source text is encrypted locally. The key appears only in the address-bar # fragment as s.html?id={id}#{key}.

Requests that leave the browser

Opening the page itself The host usually keeps IP, User-Agent, path, and time. Those records do not include tool plaintext or the # fragment.
Burn-Link ciphertext Creating a link submits ciphertext, ttl_hours, and max_reads. Without the key, the server cannot decrypt.
Analytics Production sends to /tj/ and records only page and button names. Local previews do not send. The language preference lives only in your localStorage.

02 / Compute map

Where each of the five tools runs

Password generation, Password Audit, privacy cleanup, and file encryption have no API that hands plaintext to UsePwd. Burn-Link is the only tool that submits ciphertext, and it still cannot see the source text.

Password Generator 01 Drawn locally. The request body has no generated result. Generate

Password Audit 02 Scored locally. The password is not uploaded. Audit

Privacy Cleanup 03 Cleaned locally. Pasted source never leaves this page. Clean

File Encryption Box 04 Streaming encryption on this device. Neither plaintext nor ciphertext is uploaded. Encrypt

Burn-Link 05 Encrypt locally, then submit. The server only stores ciphertext. Create

03 / Check on the spot

Open the Network panel and you can see it

Any site can print a slogan. UsePwd writes “plaintext is not uploaded by default” as steps you can re-check in the current tab. For why browser encryption and the # fragment stay out of HTTP, see the blog.

01
Open a local tool
Start with the Password Generator or Password Audit. Neither page has an API that hands plaintext to UsePwd.
02
Open the Network panel
Press F12, or right-click Inspect, then switch to Network. Clear existing records first if needed, so they are not mixed with the page’s own static assets.
03
Do one action
Generate a password, or type a secret and start an audit. Watch the new requests that follow—not the CSS and scripts from the first page load.
04
Inspect the request body
The request should not contain the password you just saw. Production may send analytics to /tj/; the payload is a page and button name, such as “Copy password,” not the secret itself.
05
Compare with Burn-Link
Then create a link on Burn-Link. The request should go to /api/secrets with ciphertext, ttl_hours, and max_reads. The key after # in the address bar should not appear in that request URL.

04 / Checkable parameters

What is written on the page can be checked

Symmetric encryption uses AES-256-GCM via the browser Web Crypto API. These numbers appear on the tool pages. They are not a separate marketing line.

Algorithm and API 01 AES-256-GCM, browser Web Crypto. Plaintext is not sent to the server to be encrypted there.

Length and size 02 Passwords 6–128 characters. Files up to 5 GB, written as .lock / .enc.

Burn-Link URL 03 s.html?id={id}#{key}. The key never enters the HTTP request.

Audit and cleanup limits 04 Not a web-wide lookup, and redaction cannot catch everything.

05 / Limits

What this page does not cover

What you can check is where computation runs and what is in the request body. The items below are outside what UsePwd can see for you, and they will not be written as upcoming features.

A compromised device 01 A malicious extension, a shared screen, or a compromised device can read the current tab. That is beyond what a web tool can promise.

Copy and screenshots 02 Burn-Link reduces repeat opens and plaintext stored on the server. It cannot block copy, screenshots, or forwards.

Storage and recovery 03 There is no account and no vault. After you close the tab, we cannot recover a password, source text, or file by user.

Support and SLA 04 No support email, and no promised uptime percentage or response time. Terms of use are in the Terms of Service.

06 / FAQ

Start with the request body

By default it is not sent to UsePwd as an HTTP request body. Password generation, Password Audit, privacy cleanup, and file encryption finish in the current tab with Web Crypto. Burn-Link only uploads ciphertext; the decryption key is appended after # and is not sent with the request.

Does plaintext leave 01 Not in the request body by default. Burn-Link only submits ciphertext; the key stays after #.

How to check on the spot 02 Open the Network panel, do one action, and see whether the request body contains what you just typed.

Can the server decrypt 03 No. Without the key after #, the server cannot unlock the ciphertext.

Does analytics record plaintext 04 No. Analytics records page and button names, not source text.

What if the device is untrusted 05 If this device is already controlled, no web tool can promise safety. That is outside what you can check here.

07 / Next

After the notes, go check

This page is not a substitute for the tools. To see a request body in the Network panel, or to read what the server actually receives, open the matching page.

Password Generator 01 Burn-Link 02 Privacy Policy 03