The authenticator and QR tools process their inputs in your browser.
Keys, codes and images
Setup keys and decoded QR data stay in page memory. The code generator does not send them to a server or write them to cookies, localStorage or IndexedDB. Uploaded QR images are read locally. Reloading the authenticator resets it to the public example; closing the page ends that page session.
Camera and clipboard
The camera starts only when you choose Open camera and grant permission. Scanning stops when you switch away from the camera panel, hide the page or leave it. Clipboard reads happen when you choose Paste; clipboard writes happen when you choose Copy.
Theme preference
Your light or dark theme choice is remembered in browser storage. Setup keys, codes and QR data are not saved with it.
Ordinary website requests
The hosting provider receives ordinary requests for pages, fonts and scripts and may keep operational access logs, including IP addresses and browser information. This version includes no analytics scripts, advertisements, session recording or third-party font requests. The network tools contact the services described below. A private preview may additionally use the hosting provider’s sign-in system.
IP and browser privacy tools
The detailed map on My IP loads city, neighbourhood and road data from OpenFreeMap, based on OpenStreetMap. Tile requests reveal your connection IP and the map areas you view to that provider. We do not send your authentication keys, a queried IP address, or GPS coordinates to the map service. The marker uses approximate coordinates from the IP-location service; it does not identify your home or street. The browser-local country overview remains available if detailed tiles cannot load. See OpenFreeMap privacy.
Opening My IP contacts ipify to detect public IPv4 and IPv6. My IP and IP lookup send the detected or queried public address to IPWho.is for network information, with GeoJS as a fallback if the first service is unavailable. These services see ordinary connection information, and their own privacy policies apply. Lookup results are cached briefly in page memory; they are not saved with your theme preference. The optional IP address passed between our lookup pages is removed from the displayed URL after loading, but an ordinary page request may appear in hosting logs.
WebRTC testing starts only when you choose Run test. It creates a temporary data channel and contacts Cloudflare’s public STUN service. It does not request camera or microphone media. Candidate information remains in page memory and is included if you copy the findings.
DNS testing starts only when you choose Run test. It asks our same-origin session endpoint to allocate a bash.ws test ID. That endpoint contacts only the fixed bash.ws session service. Your browser then contacts bash.ws and fresh test subdomains so its authoritative DNS infrastructure can observe the resolvers answering those queries. The current session and report remain in page memory here; bash.ws handles its own test data under its privacy policy. IPWho.is, ipify and GeoJS also apply their own provider policies. This website does not save diagnostic history or provide a cloud account.
Downloads and contact
A downloaded QR stays wherever you save it. The contact tool prepares a message in your email application or copies it to your clipboard; it does not submit a form to a server. If you email us, your email provider and ours process that message.
Changes and questions
This page will be updated when the product’s data handling changes. Questions can be directed through Contact.