Privacy policy

Who we are

pass.new is run by HSPINK & COMPANY - FZCO, a company registered in Dubai, United Arab Emirates ("we", "us"). Contact: hello at pass dot new.

Passwords you generate or check

Passwords and passphrases are made in your own browser and are never sent to us. The password checker also runs in your browser. For the leak check, your browser sends only the first 5 characters of a SHA-1 fingerprint of the password to Have I Been Pwned (a method called k-anonymity). That matches hundreds of different passwords, so neither they nor we can learn yours.

Things you share or store with our tools

Everything you lock is encrypted in your browser before it reaches us. We only ever hold scrambled data we can't read, because the key stays in your link (after the #, which browsers never send to websites) or with the people you choose.

• Secure links: the scrambled data is deleted once the link has been opened the number of times you chose, or when it expires (after 1 hour, 24 hours or 7 days at most).
• Time-locks: the scrambled data is kept until the chosen time, then for 90 days, then deleted.
• Dead man's switch: we keep your email address and name, your contacts' names and email addresses, your check-in schedule and the scrambled message, so we can run the switch. Unconfirmed switches are deleted after 7 days; released ones 90 days after release. You can delete yours at any time with your management link.
• Canaries: we keep your alert email address, the label you gave it, and a fingerprint (SHA-256) of the decoy password, never the password itself. When a canary is triggered, we keep the time, rough location (city and country) and device type, and email you the details, including the IP address. You can delete a canary at any time.
• Split into blocks: done entirely in your browser. Nothing is sent to us.
• "Email it to a friend": we send the email through our email provider and don't keep either address. A scrambled fingerprint of the recipient's address is kept for up to 2 days to stop misuse.
• API keys: we keep a fingerprint of your key (never the key itself), its usage count and the email address you gave when you created it.

Visitor statistics

We don't use cookies for visitors, advertising or tracking, and we don't use third-party analytics. We count anonymous daily totals, such as page views, which country and network visits come from, the type of device and browser, the site that linked here, and roughly how long pages stay open. To count unique visitors, we use a scrambled daily code that can't be traced back to you and is deleted after 2 days.

To stop abuse, short-lived counters are keyed by IP address and expire within about an hour. We don't otherwise store IP addresses.

Companies that help us

• Cloudflare hosts the website and stores the encrypted data. Like any web host, it handles your connection, including your IP address, to deliver the site.
• Resend sends our emails (alerts, check-ins and links you ask us to email).
• Have I Been Pwned receives the 5-character fingerprint prefix described above, when you use the leak check.

We don't sell or share your data with anyone else.

Your choices

You can delete a dead man's switch or canary at any time with its management link. To ask about any data we hold, or to have it removed, email hello at pass dot new.

Changes

We may update this policy. The version on this page is the one that applies.

Last updated 4 November 2026.