Privacy Policy

Data used by the app

The app uses the site address and original password you enter to calculate a hashed password entirely on your iPhone. The app does not send those inputs or generated passwords to the developer or to a server.

The app has no user accounts, analytics, advertising SDKs, tracking, or cloud sync. It does not automatically upload credentials, usage information, or session data.

No network connections or wireless communication

• The app does not open network sockets.
• The app does not make HTTP or HTTPS requests.
• The app does not call remote APIs.
• The app does not connect to servers.
• The app does not run background network services.

Password calculation uses local code and Apple’s on-device CryptoKit framework.

The app does not use Wi-Fi to communicate. The app does not use cellular or mobile data, including 4G/LTE and 5G, to communicate. The app does not use Bluetooth to communicate. The app does not use nearby-device discovery.

The app does not scan wireless networks. The app does not inspect network status. The app does not request local-network access. The app does not request Bluetooth access.

The site address or full URL you enter is only an input to the local password calculation. The app does not visit that website. The app does not look up its address through DNS. The app does not contact that website. The app does not sign in to your accounts. The app does not change your accounts.

The optional website and Contact buttons hand off to your browser or email app only when you tap them, as described below. Those actions are separate from offline password generation.

No user files or persistent records

PwdHash does not write your site addresses, input passwords, generated passwords, or session history to files, logs, databases, preferences, or the Keychain. The app does not export credential files. The app does not create credential backups. The app does not save the fields for restoration on relaunch. Only the current session is kept in memory.

The Clear when leaving app setting is also temporary and returns to its enabled default when the app is relaunched. Choosing Copy places a result on the local iOS clipboard; its handling is described separately below.

Session retention and clearing

Clear when leaving app is enabled by default. It clears the current fields when the app enters the background. You can turn it off to reuse the inputs while switching apps.

A session expires after five minutes without interaction. Expiry is checked before an action is accepted and before a returning session is shown. When iOS suspends the app, a timer may not run in the background; with clearing on exit disabled, expiry is enforced when the app next runs, rather than promising erasure at exactly five minutes while suspended.

You can use Clear to remove the current fields, generated result, and an app-owned clipboard item when the app still owns it. The app also resets its UI and undo state. The operating system and its frameworks manage other memory copies, so clearing is not a guarantee that every physical byte has been overwritten.

There is no app account or server-side password record to delete.

Clipboard

When you tap Copy, the generated password is placed on the iPhone’s clipboard with device-only handling and a 60-second expiration. Universal Clipboard sharing is excluded. iOS manages that expiration, including while PwdHash is suspended.

Leaving the app clears its fields by default but preserves an intentional copy long enough to paste. Another app’s newer clipboard item is not cleared. Copies you paste into other apps are controlled by those apps.

External links and support email

The support, privacy-policy, and original-project links in About & credits open fixed website addresses in your external browser only when you tap them. Contact opens your email app with the support recipient filled in. PwdHash does not attach your entered site address, input password, or generated password to these website or email links.

Your browser or email app may use a network connection to load a website or send a message and handles that activity under its own privacy practices. These optional actions are not needed to generate passwords, and PwdHash does not send a support message automatically.

If you email support, your sender address, message, and any information you choose to include are delivered through email providers and used to handle your request. Please use example inputs and do not send real passwords. You can contact the developer about a message you sent, including to request its deletion.

This website

This policy’s app statements describe the native iOS app. Visiting this website is separate from using the app. Cloudflare hosts nmic.app and processes ordinary connection and request information, such as an IP address and requested URL, to serve and protect the website. See Cloudflare’s privacy policy.

The website does not include advertising or analytics scripts, and it does not ask you to enter passwords.

Policy updates

Changes to this policy will be published at this URL with an updated date.