Privacy notice
This site, md5.me, is operated by Plus 1 Limited, a company registered in Greece. We treat user privacy as foundational to the product, not an afterthought, and the goal of this notice is to be honest about what does and doesn't happen when you visit.
The short version
When you use the tools on this site, the data you type into the input fields, passwords, plaintext you want hashed, anything else, stays in your browser. Nothing you enter is transmitted to our server, because we don't operate one for the application. All hashing, password generation, salt generation, and SQL drafting runs in your browser via JavaScript. You can verify this in the Network tab of your browser's developer tools.
The site itself, however, is delivered to you by infrastructure providers, and that involves a small amount of unavoidable data exchange. The rest of this notice explains it honestly.
What data is processed when you visit
By Cloudflare (CDN and DDoS protection). Your IP address, the URL you requested, your browser's user agent, and standard HTTP headers are processed by Cloudflare in order to deliver the page. Cloudflare may set a __cf_bm cookie for bot detection. Cloudflare's privacy practices are documented at www.cloudflare.com/privacypolicy.
By Google Fonts. The site loads two typefaces, JetBrains Mono and Space Grotesk, from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Loading these typefaces causes your browser to make a request to Google's servers, which means Google receives your IP address and the URL you came from. Google's data practices are documented at policies.google.com/privacy. We are evaluating self-hosting these fonts in a future update; if you'd prefer to avoid the dependency now, browser extensions like Decentraleyes can serve them locally.
By Statcounter (visit analytics). This site uses Statcounter to collect basic visit statistics: page views, referrer URLs, and approximate geography derived from IP address. When you visit, Statcounter's script loads from www.statcounter.com and logs the visit. No personally identifiable information beyond what is standard in any web server request is collected or shared with us. Statcounter's privacy policy is at statcounter.com/about/legal/privacy-policy.
By the origin server. The server hosting the site logs each request: IP, URL, user agent, response code, for normal operational purposes (debugging, security monitoring). These logs are retained for a short rolling window and are not shared with third parties.
What data is not collected
- No advertising analytics. The site uses Statcounter for basic visit statistics only. No ad networks, retargeting pixels, or behavioural profiling.
- No advertising. No ad networks, no retargeting pixels, no third-party trackers.
- No accounts. There is nothing to sign up for and no user database.
- No marketing cookies.
- No data from the tool inputs. Your hash inputs, password seeds, salt outputs, and
.htpasswdmaterial are processed entirely in your browser and never reach our infrastructure.
Your rights under the GDPR
If you are in the European Economic Area, the United Kingdom, or another jurisdiction with comparable rules, you have the right to access, rectify, erase, restrict, port, and object to processing of personal data we hold about you. In practice, the only personal data tied to your visit is the request log described above, and only for as long as it's retained.
To exercise any of these rights, or to file a complaint about our processing, please contact us via LinkedIn DM. We aim to respond within thirty days.
Changes to this notice
If we change anything material, a new analytics provider, a different CDN, a self-hosted fonts setup that removes the Google dependency, we'll update this page and bump the "last updated" date. There's no version history yet because this is the first version.
Plus 1 Limited · Greece · md5.me