Salt The Pass

How It Works

SaltThePass is a password generator that will help you generate unique, secure passwords for all of the websites you visit based on a single Master Password that you remember.

Please read our Help pages to learn how you can best use this site.

MASTER PASSWORD

DOMAIN NAME

DOMAIN PHRASE

SALTED PASSWORD

LENGTH

Advanced Settings

HASH

DOMAIN NAME RULES

NORMALIZE DOMAIN NAME

About

SaltThePass helps you generate passwords for all of the websites you visit. Unlike traditional password managers, SaltThePass does not actually store, save or manage any passwords for you. Instead, SaltThePass is a repeatable algorithm that you can use to generate unique passwords for all of your websites. Instead of storing each website's password in a password manager or writing it down on a piece of paper, you can look it up (re-generate it) from anywhere you have internet access.

The problem users face today is how to efficiently yet securely manage all of their passwords for all of the websites they visit. To simplify things, many people simply re-use one password on multiple websites. Unfortunately, this means that if a hacker gains access to a password on one of their websites, all of their accounts could be vulnerable, since many people also use the same email address or login name on all of their websites. Recently, this has become an alarming problem due to several high-profile password breaches on websites such as LinkedIn, Yahoo, Evernote and many others.

SaltThePass helps you avoid password re-use over multiple websites by having you come up with a Master Password that is known only to you (and you never disclose it to anyone or use it anywhere else). When a password for a new website is needed, such as the first time you visit foo.com, SaltThePass combines your Master Password with the website's name (foo.com), and inputs this into a one-way cryptographic hash function, the output of which can be used as a password for the website (the Salted Password). This algorithm is deterministic, so the same Salted Password is generated every time. And since the website name is used as an input to the algorithm, the Salted Password is different for each website.

The benefit of this is that you just have a single Master Password to remember. Since you never disclose it to anyone else or use it for any reason except for on the SaltThePass website to generate a Salted Password, a security breach at one website does not directly reveal your Master Password or your passwords for any other website.

However, if a website stores your Salted Password insecurely (for example, in plain text) and it is stolen, an attacker who knows you use SaltThePass could try to guess your Master Password by brute force. The hash functions SaltThePass uses are designed to be fast, so a short or common Master Password could be guessed. This is why your Master Password should be long and unique. A passphrase of several random words is a good choice. See Recommended Best Practices and Password Security.

SaltThePass was created by Nic Jansma.

Data Security

SaltThePass never transmits, stores, or monitors your secure data (or any form of it), which includes your:

Master Password
Domain Names
Domain Phrase
Salted Passwords

Except in one circumstance: If you enable Domain Name Rules, SaltThePass will send the first letter (and only the first letter) of the Domain Name to the SaltThePass server for the purpose of downloading the subset of Domain Name Rules that start with that letter. For example, if you enable Domain Name Rules and you enter foo.com as the domain name, SaltThePass will fetch the rules for websites starting with "f". This HTTP request will look like this:

https://saltthepass.com/rules/f

You can verify and confirm all of this by reviewing the website's JavaScript and HTML code, and by monitoring the HTTP requests coming from the website after you load it. None of the requests the website makes contain your Master Password, Domain Name, Domain Phrase or Salted Password. Besides the Domain Name Rules request above, you may see:

Requests for the website's own files (HTML, CSS, JavaScript, images and fonts)
Google Analytics, to count page views
Browser-generated error reports (such as Content Security Policy or network errors), which are sent to our monitoring service only when a problem occurs

See the Privacy Policy for details.

Settings and Cookies

If you tell it to, SaltThePass can remember your preferences from visit to visit. The full list of preferences is:

Whether Domain Name Rules are enabled or not
Your default Salted Password length
The Hashing Algorithm you use
Whether Normalize Domain Name is enabled or not

These preferences are stored in HTML5 local storage if your browser supports it. If not, a single cookie (called settings) is set.

You must click on Set As Default for these settings to be saved. Settings are not saved by default.

Access to SaltThePass is only available over SSL for your security.

Note: SaltThePass cannot clear your clipboard after you copy your Salted Password to it. Please make sure to do so, otherwise, a malicious program might sniff it.

Password Security

SaltThePass never stores your passwords, but your Salted Passwords are only as secure as the Master Password behind them.

If a website you use stores your Salted Password insecurely (for example, in plain text) and is breached, an attacker who knows you use SaltThePass could try to guess your Master Password offline: they would repeatedly run the algorithm with a guessed Master Password and the website's Domain Name until the output matches your stolen Salted Password. If they succeed, they can generate your Salted Passwords for every other website. Modern graphics cards (GPUs) can try billions of guesses per second, so the length and randomness of your Master Password is the most important thing protecting you.

Recommended Best Practices

Use a long, random Master Password: at least 16 random characters, or at least 5 random Diceware words (6 or more gives you a bigger safety margin). Generate it randomly rather than making one up, and never use it anywhere else. See Master Password Strength.
Personalize the Domain Name in a consistent way that only you know, such as always entering domains in UPPERCASE, or always adding the same character to the end. This acts as a personal "salt" that an attacker can't see in your Salted Passwords. See Personalizing the Domain Name.
Use the SHA-3 hashing algorithm (the default). Avoid MD5 and SHA-1, which are much faster for an attacker to guess. See Hash Comparison.
Use long Salted Passwords: keep the default length of 20 characters (or longer) wherever the website allows it.

Master Password Strength

The table below shows the average time it would take to guess a randomly-generated Master Password, for an attacker making 10 billion guesses per second (roughly a few high-end GPUs attacking the default SHA-3 hash).

Master Password	Strength	Average time to guess
8 random lowercase letters	38 bits	10 seconds
3 random Diceware words	39 bits	25 seconds
8 random characters (any keyboard character)	52 bits	4 days
4 random Diceware words	52 bits	2 days
12 random lowercase letters	56 bits	55 days
5 random Diceware words	65 bits	45 years
10 random characters	66 bits	85 years
16 random lowercase letters	75 bits	700 years
6 random Diceware words	78 bits	3,500 years
12 random characters	79 bits	7,500 years
7 random Diceware words	90 bits	Billions of years
16 random characters	105 bits	Billions of years
20 random characters	131 bits	Billions of years

Notes:

"Random characters" are chosen from all 94 printable keyboard characters (upper- and lower-case letters, numbers and symbols). Diceware words are chosen at random (by rolling dice) from a list of 7,776 words.
These times only apply to passwords that are truly random. Passwords chosen by people (names, words, dates, song lyrics, keyboard patterns, or common substitutions like "P@ssw0rd") appear in attackers' guessing lists and can be guessed in seconds, regardless of their length.
A well-funded attacker with 1,000 GPUs would be 1,000 times faster: 5 Diceware words would take about 2 weeks on average, while 16 random characters would still take billions of years. Computers also get faster over time.
Using MD5 or SHA-1 instead of SHA-3 makes every row 10 to 30 times faster to guess (see below).

Hash Comparison

The hashing algorithm you choose affects how quickly an attacker can make guesses. All of the available hashes are still "one-way" (a Salted Password can't simply be reversed), but older hashes were designed to be fast, which helps an attacker guess.

Hash	Max length	Approx. guesses per second (one GPU)	Time to guess 10 random characters (one GPU)	Recommendation
MD5	22	~150 billion	~6 years	Not recommended
SHA-1	27	~50 billion	~17 years	Not recommended
RIPEMD-160	27	~25 billion	~35 years	OK
SHA-2 (512)	86	~5 billion	~170 years	Good
SHA-3 (Keccak-512)	86	~5 billion	~170 years	Recommended (default)

Guessing speeds are rough estimates for a single modern high-end consumer GPU, based on published password-cracking benchmarks, and vary by hardware and software. The important point is the relative difference: MD5 and SHA-1 can be guessed roughly 10 to 30 times faster than SHA-2 or SHA-3. MD5 and SHA-1 are only offered for compatibility with existing Salted Passwords.

Personalizing the Domain Name

The Domain Name is public: an attacker who has stolen your Salted Password for foo.com knows that you entered "foo.com". Because everyone who uses SaltThePass enters the same Domain Names, an attacker can also guess common Master Passwords for foo.com once, and check the results against every stolen foo.com password at the same time.

You can defend against this by always changing the Domain Name (or Domain Phrase) in a consistent way that only you know. This acts like a personal "salt": it isn't visible in your Salted Password, so an attacker who only has your Salted Password would also have to guess your modification. For example, you could always:

Enter domains in UPPERCASE: FOO.COM
Enter domains in a mixed case pattern of your own: fOo.CoM
Add the same character or word to the end of every domain: foo.com#
Use the same Domain Phrase for every website (and change it for a website only when you need a new password there)

Keep in mind:

Your modification must be applied exactly the same way every time, on every device, or you will generate a different Salted Password.
If you paste full URLs (such as https://foo.com/login) with Normalize Domain Name enabled, the domain is lower-cased, which would undo an upper- or mixed-case modification. Domains you type without http:// are not changed.
Domain Name Rules ignore upper- and lower-case, and are not affected by the Domain Phrase, but adding characters to the Domain Name (such as foo.com#) will stop the rules from matching.
Adding something to the beginning of the Domain Name (such as #foo.com) is exactly the same as adding it to the end of your Master Password, because the two are joined together. That still makes your Master Password stronger, but it doesn't protect you in addition to it.
A simple modification, such as UPPERCASE, is one of the first things a determined attacker would try. It stops attackers who guess against everyone at once, and adds a little extra work for one who is targeting you, but it is not a substitute for a long, random Master Password. The more unusual your modification, the more it helps.

Gotchas

There are some things to be aware of if you're going to use SaltThePass to help you manage passwords for all of the websites you visit.

Password Restrictions

Many websites have restrictions on the password you can use. For example, some websites require you to enter a password between 6 and 12 characters. Other websites require that you only use numbers and letters, while others require that you include at least one dash or underbar.

Since the SaltThePass algorithm uses the output of a hash to generate the Salted Password, it may not conform entirely to the website's password requirements.

One way to deal with this is to mentally note these requirements and adjust the password you use to conform to them. For example, you could use only the first 8 characters of the Salted Password if the website restricts your password to 8 letters. Or, if the website requires a dash ('-') in your password, and the Salted Password does not have one, you could add a dash to the end of the Salted Password.

Unfortunately, this is error-prone, as websites generally only show their password requirements when you are creating an account or changing the password, not when you're logging in. For example, if you don't remember the requirements while logging in, you might not remember to add a dash to the end of the Salted Password.

SaltThePass can help avoid this problem if you use Domain Name Rules. Domain Name Rules are a community-supported database of password restrictions for popular websites. If the Domain Name you enter is in the database, SaltThePass will attempt to automatically modify the Salted Password to conform to the rules. See the Domain Name Rules section for details.

SaltThePass does not have an input field for the login name you chose for the website (and thus it cannot remind you later what that login name is when you're trying to login). Thankfully, many websites let you use your email address as your login name. If not, you may have to keep a separate database (i.e. a password manager) or try to remember them on your own.

Password Changes

At some point you may need to change a password on one of your websites. For example, after a security breach, many websites reset all of their user's passwords. The three inputs to the Salted Password are your Master Password, the Domain Name, and the Domain Phrase. The Domain Phrase is optional, and can be used to help with this situation.

You can use the Domain Phrase to modify your Salted Password after the Master Password and Domain Name have been entered, since those fields do not change per website. For example, if your password needs to be changed, you could enter "2" into the Domain Phrase because it's the second password you needed to enter for this website.

If you're using a password manager, you could note that you're on the "second password" for foo.com within its database, and enter "2" into the Domain Phrase field to re-generate your second password.

Multiple Passwords

You may need multiple passwords for a single domain.

If you maintain multiple login names for foo.com, you could share the same Salted Password for all of the login names. If you don't want to do this, you could set the Domain Phrase field to the login name. For example, if you maintained both "bar" and "baz" users on foo.com, you could set the Domain Phrase to "bar" when generating that account's Salted Password.

Use with Password Managers

SaltThePass can be used in conjunction with traditional password managers, such as:

For example, you can save your login name and the Salted Password that SaltThePass generated. The benefit of this approach is that you can use the traditional password manager's features (such as auto-filling web forms), while having the SaltThePass.com website as a backup in case you don't have access to your password manager.

The traditional password manager can also store login details that cannot be generated on the SaltThePass website, such as your login name and whether or not you've had a password change.

Algorithm

The SaltThePass algorithm is pretty simple. Concatenate the Master Password, the Domain Name, and the Domain Phrase (optional). Send this through a hashing algorithm (SHA-3 is default, others are available), base64 the result, and then finally trim to the desired output length. In pseudo code:

Salted Password = Trim(Base64(Hash(Master Password + Domain Name + Domain Phrase)))

Notes:

For base64, we use the base64url variation of RFC 4648 , which replaces the last two characters of plus "+" and forward-slash "/" with minus "-" and underscore "_" to produce Salted Passwords that are more likely to pass the password requirements of sites that limit the characters that can be used in a password.
Any trailing equals "=" padding characters are removed from the base64 output.
The three inputs are concatenated directly, with no separators between them.
The default SHA-3 hash is the original Keccak-512 algorithm, not the final SHA3-512 standard. See Hashing Algorithm for details.

Test Vectors

If you implement the algorithm yourself, you can use these examples to make sure your implementation produces the same output as SaltThePass. The Salted Passwords below are shown at their full length (before trimming).

Hash	Master Password	Domain Name	Domain Phrase	Salted Password
SHA-3	`password`	`example.com`	(empty)	`68s2c978FFfydtMN_hKLaNVS6j14TfHnHg24yCJrjqZnFr6yiK96eVHDu-dSlhxZbOvK3SXOomwxzoGQ-4hxFA`
SHA-3	`password`	`example.com`	`2`	`DDBTEf6qcoI-0tto1oIokog7Nlf15RPyS6sYnb_nOgd0AkHJn91nPXUuhmEkPFO_w9dm42vukBkzifGiOmYiPw`
SHA-3	`correct horse battery staple`	`www.Example.com/login`	`bob`	`rITikK-wyLqQWMcfpx82912i-jVEHa_OObkSxjbfq59RVJ30Bu_Dwl_ZPHQlNxPfTHDfBu5dawOpq7b7gNXRBA`
SHA-2	`password`	`example.com`	(empty)	`elrVxT7_rHWsmiGQEVhyccQudLht5sRuVM2eZfodj3YLCXUZ7JxuzTM4Cv9_omZlWqsd21_Dwjw6OOeD8SWutg`
MD5	`password`	`example.com`	(empty)	`WG6Jq7Y94aWFBy5u1DSIXQ`
SHA-1	`password`	`example.com`	(empty)	`Zk-Oe3DKT7Wmp_AUKm0eXGckSeI`
RIPEMD-160	`password`	`example.com`	(empty)	`aVZuI0Hv_d5g2Y4zFm-cYMgnk9Y`

For example, with SHA-3, a Master Password of password, a Domain Name of example.com and a length of 20, the Salted Password is 68s2c978FFfydtMN_hKL.

The algorithm SaltThePass uses is available open-source at github.com/nicjansma/saltthepass.js

Terms

Master Password

Your Master Password is a password that you keep safe and only use on SaltThePass. Ideally, you should never disclose it to anyone else, or even write it down. SaltThePass uses your Master Password in conjunction with the Domain Name and Domain Phrase (optional) to generate the Salted Password.

Your Master Password should only be used on SaltThePass to generate Salted Passwords. SaltThePass does not put any restrictions on what the password can be -- it can be as short or long as you want, with any combination of characters. Any character that can be input into a textbox is valid. Ideally, your Master Password should be as long as you can possibly remember. Password phrases are useful for remembering long passwords.

The key is to never use your Master Password for any reason except on SaltThePass.com. If you use your Master Password to log in to other websites, and they get compromised, they might try to use it on SaltThePass to generate all of your other passwords.

Domain Name

For simplicity, the Domain Name you use should match the website you're generating a password for. SaltThePass uses your Master Password in combination with the Domain Name and Domain Phrase (optional) to generate your Salted Password.

By default, SaltThePass does not normalize the Domain Name when generating the Salted Password. For example, SaltThePass does not lower-case all of the letters, nor strip sub-domains from it. This means that you need to be consistent with how you enter domains. (You can enable Normalize Domain Name to lower-case the Domain Name and strip the protocol, port and path from URLs, but sub-domains are never stripped.) If you enter "facebook.com" when you create your password, and later try to use "www.facebook.com", you will get a different Salted Password. Similarly, you should either always include the protocol ("http://") or never use it.

If Domain Name Rules are enabled, SaltThePass uses your Domain Name to help you deal with password restrictions for that website.

Domain Phrase

The Domain Phrase is an optional field that can be used to differentiate multiple passwords on the same website.

For examples, see Password Changes or Multiple Passwords for a Single Domain.

Salted Password

The Salted Password is the output of your Master Password combined with the Domain Name and Domain Phrase (optional) of the website. See the algorithm section for exact details on how it is generated.

Nothing is stopping you from taking the Salted Password and always mentally applying an additional transformation on it, which only you know. For example, you could take the Salted Password and always add a "1" to the end of it. Or, you could swap the first and last characters. While these are simple examples, they can add a small additional layer of protection against automated attacks that assume an unmodified Salted Password. However, simple transformations are easy to guess, so they are not a substitute for a long, unique Master Password.

Domain Name Rules

Domain Name Rules help you customize your Salted Password to ensure it works for the target website. For example, some websites require that you input between 6 to 12 characters. Or, that you must include a dash ('-') or underscore ('_') in the password. Or, that you can't include numbers.

Domain Name Rules will automatically rewrite your password (in a consistent manner) to ensure the Salted Password works with your website.

Domain Name Rules are based on the Domain Name you enter. This means that if you enter "bar.foo.com" as the Domain Name, but we only have "foo.com" in the password database, the rules will not be applied.

If you enable Domain Name Rules, SaltThePass will download a community-supported database of rules and store it in your browser cache. Once you enter a Domain Name, it will search for it in the database. If found, it will ensure your Salted Password satisfies the website's requirements.

The Domain Name Rules database is split into multiple databases based on the domain's first letter. When you enter a Domain Name, SaltThePass fetches the database for that domain's first letter. The database is compressed and optimized, so it should not take a lot of storage. SaltThePass downloads these partial databases to your browser's cache, then searches for the full domain match from your cache, so the full Domain Names you enter are never disclosed to the SaltThePass.com server or to anyone else (access to the site is SSL encrypted as well).

Domain Name Rules are not enabled by default.

Normalize Domain Name

If enabled, the Normalize Domain Name setting takes the Domain Name and applies the following algorithm before generating the password:

Lowercase the entire Domain Name
If a URL, keep only the domain part of the URL (getting rid of the scheme, port and path)

For example, the following URLs would be normalized as:

http://foo.com is normalized to foo.com
http://foo.com/bar is normalized to foo.com
HTTP://FOO.COM is normalized to foo.com

Non-URLs are not affected.

Normalize Domain Name is disabled by default. You can enable Normalize Domain Name in the settings.

Hashing Algorithm

SaltThePass uses a cryptographic hash function as part of the algorithm that generates your Salted Password. There are several hash functions you can choose from. By default, SHA-3 (512) is used, but you can choose from any in the list below. Note: SaltThePass's SHA-3 option is the original Keccak-512 algorithm (as implemented by CryptoJS), which won the NIST competition but differs slightly from the final SHA3-512 standard (FIPS 202). If you re-implement the algorithm yourself, use a Keccak-512 implementation (often named keccak512), not SHA3-512, or you will get different passwords. Each hash function will provide different output, so if you ever change the hash function you use, you will get a different Salted Password.

The available hash functions are listed below along with the maximum password length they can generate:

MD5 (128 bits): 22 characters Not recommended
SHA-1 (160 bits): 27 characters Not recommended
SHA-2 (512 bits): 86 characters
SHA-3 / Keccak (512 bits): 86 characters
RIPEMD-160 (160 bits): 27 characters

MD5 and SHA-1 are not recommended, because they are much faster for an attacker to guess. See Hash Comparison.

SaltThePass uses the open-source CryptoJS JavaScript cryptographic library for MD5, SHA-1, SHA-2, SHA-3, RIPEMD-160 hashing and Base64 encoding.

The algorithm SaltThePass uses is available open-source at github.com/nicjansma/saltthepass.js

FAQ

1. What is the difference between SaltThePass and a traditional password manager, such as KeePass or LastPass?

SaltThePass is different from traditional password managers in that it never stores, saves or keeps your logins or passwords. Instead, SaltThePass gives you an algorithm you can use to repeatedly generate passwords for multiple websites.

One benefit of SaltThePass over a traditional password manager is that you can use it to generate your passwords even if you don't have access to your password manager. As long as you have internet access, you can generate your passwords.

An additional benefit is that you don't need to synchronize your passwords. If you add a password to your traditional password manager on your desktop machine, it might not automatically get synchronized to your laptop. Since SaltThePass is an algorithm, you can always find your passwords as long as you know your Master Password and the Domain Name .

A final benefit is that SaltThePass never stores your passwords. Since traditional password managers store your password on your disk or at the program's data center, there is the possibility that a hacker could gain access to them due to a security breach or a technical fault.

One downside of the SaltThePass.com website over a traditional password manager is that you have to have an internet connection to be able to visit SaltThePass.com so you can generate your passwords. However, a mobile app that doesn't require internet access is available for phones and tablets.

SaltThePass can also be used in conjunction with a traditional password manager for added flexibility.

2. What would happen if SaltThePass disappears?

SaltThePass is provided to you, for free, by Nic Jansma. I have no intention of ever shutting the website down, as I use it myself daily. However, should the site disappear from the internet someday, you would still be able to use the same algorithm that SaltThePass uses to generate your passwords, as it is fully described and open-source.

You should be able to use the mobile applications or command-line saltthepass interface indefinitely

3. How can I make my password even more secure?

See Recommended Best Practices. In short:

Make sure your Master Password is long and random: at least 16 random characters, or 5 or more random Diceware words.
Personalize the Domain Name in a consistent way that only you know.
The default SHA-3 (Keccak-512) hashing algorithm, based on the winner of the NIST hash function competition, is a good choice. The other hashing algorithms are available mainly for compatibility; choosing a different one does not meaningfully increase your security, and MD5 and SHA-1 are considered weak.
You could always use the output of the Salted Password and apply your own "mental algorithm" to it. For example, you could prepend every password with "foo" or swap the first and last characters. This adds a small amount of protection, but the length of your Master Password matters far more.

4. What if I don't have internet access?

A mobile version of SaltThePass that won't require internet access is available.

If you have access to a computer, you can use the command-line saltthepass interface if pre-installed

5. What if you don't have the correct Domain Name Rules for my domain?

If there is a domain name that you're creating a password for that we don't have the correct Domain Name Rules for, please click on the Suggest button that appears when there is No Match. A form will popup that you can use to suggest a domain.

Change Log

October 30, 2026

MD5 and SHA-1 are now marked as Not recommended in the Hashing Algorithm settings, with a warning when selected
New Help sections: Recommended Best Practices, Master Password Strength, Hash Comparison, Personalizing the Domain Name and Test Vectors
Clarified that the SHA-3 option uses the original Keccak-512 algorithm
Help and Privacy Policy updated to describe analytics and error reporting
Security hardening: a stricter Content Security Policy and Subresource Integrity for the site's scripts and styles
Upgraded to Google Analytics 4

June 2020

Reporting-API HTTP Header added to collect error reports

November 2017

Normalize Domain Name option added

March 2013

Initial release

Contact

SaltThePass was created by Nic Jansma. Feel free to contact him.

Mobile

Note:saltthepass.com is a Progressive Web App and can be used offline. You just need to visit this website once for it to be available offline.

The SaltThePass mobile app is available for iOS and Android devices. It works on both phones and tablets. The app has all of the features of the website and does not require any internet connectivity.

It is free and available in the following app stores:

Available for iPad, iPhone and Android devices

Command-Line

The saltthepass NPM package contains a command-line (CLI) interface. You just need NodeJS installed to use it.

npm install -g saltthepass

> saltthepass
Options:
  --hash, -h      Name of the hash, e.g. md5
          [choices: "md5", "sha1", "sha2", "sha3", "ripemd160"] [default: "md5"]
  --password, -p  Master Password                                     [required]
  --domain, -d    Domain Name                                         [required]
  --phrase, -r    Domain phrase
  --help          Show help                                            [boolean]
  --version       Show version number                                  [boolean]

> saltthepass -h sha3 -p password -d domain -r phrase
_PwlhSzK8_Q1M73_woHVXi-f_-hQJ_ht8_SCx6KvOdKiMSaqmV4Dhagf-toiMIqsvW04gJkGWU9eGAuyDQtvzw

Passwords

Please see Help → Data Security for details about how your Master Password, Domain Name, Domain Phrase and Salted Password are used.

Cookies

SaltThePass will only use cookies if you tell it to remember your settings and if your browser does not support HTML5 Local Storage. Please see Help → Settings and Cookies for more details.

Google Analytics may set some cookies (starting with _ga). See below for details.

Google Analytics

Google Analytics is a web analytics tool that helps website owners understand how visitors engage their website. Visitors to this website who have JavaScript enabled are tracked using Google Analytics. We use Google Analytics to help us understand our visitors better, to see what pages they visit, and to look for trends and changes in our website's popularity. No personally identifying information is tracked by Google Analytics.

Google Analytics uses "cookies", which are text files stored on your computer, to collect standard Internet log information and visitor behavior information under a random identifier. The information generated by the cookie about your use of our website is transmitted to Google, along with your IP address (which Google uses to derive approximate location, but does not log or store).

We will never (and will not allow any third party to) use statistical analytics tools to track or to collect any Personally Identifiable Information (PII) of visitors to our site. Google will not associate your IP address with any other data held by Google. Neither we nor Google will link, or seek to link, an IP address with the identity of a computer user. We will not associate any data gathered from this site with any Personally Identifiable Information from any source, unless you explicitly submit that information via a fill-in form on our website.

All of our activity falls within the bounds of the Google Analytics Terms of Service.

You can opt out of Google Analytics if you prefer.

Error Reporting

SaltThePass asks your browser to report certain errors (such as Content Security Policy violations or network errors) to our monitoring service, Akamai mPulse. Your browser only sends these reports when a problem occurs. They include the page URL and details about the error, but never your Master Password, Domain Name, Domain Phrase or Salted Password.

Changes

If our privacy practices change at any time, we will update this privacy policy to reflect the changes.

Questions?

Any questions regarding any of these policies may be sent to Nic Jansma.