The Duck Laws
These are the sacred, immutable, somewhat dramatic rules that govern how CyDuck operates. Read them. Frame them. Tattoo them on your forearm if you must.
Article I — We See Nothing
All password generation and analysis runs entirely in your browser using JavaScript. We have no server processing your passwords. Not because we're lazy — because we designed it that way. We physically, structurally, fundamentally cannot see what you generate or type. It's like asking what's in a locked safe we've never been near. Quack.
Article II — We Store Nothing
No cookies. No local storage. No analytics that track individual users. When you close this tab, it's like you were never here — which is either privacy nirvana or existentially unsettling, depending on your worldview. The only external request we make is to a word API when you use the Passphrase tab. That request contains zero personally identifiable information. Just a number. "Give me 4 words." Done.
Article III — We Share Nothing
We do not sell your data. We do not share your data. We do not monetize your data. Mostly because there is no data. It's like trying to sell a photograph of something invisible. This site earns through contextual tools and optional premium features — never through your personal information. Your secrets die with the session.
Article IV — The Code is Open
You can view the entire source code of any page right now. Press Ctrl+U on Windows/Linux or Cmd+Option+U on Mac. No obfuscation. No hidden scripts. No minified blob of chaos that could be hiding anything. What you see is what runs. We believe in radical transparency, which is a fancy way of saying we have nothing to hide.
Article V — The Duck Doctrine
If it quacks like it's safe, floats like it's private, and looks like it's free — it is those things. CyDuck was built on the principle that everyday people deserve professional-grade security tools without handing over their email address, accepting a 47-page EULA, or watching an ad for a mattress they looked at once in 2019.
Article VI — When Duck Law Changes
If Duck Law ever changes in a meaningful way, we'll say so clearly — not bury it in a paragraph nobody reads at 2am. The date below is when this version was last updated. If the date is old, nothing important has changed.
Last updated: January 2026 · Version 1.0
Wait, this is actually a privacy policy?
Yes. Dressed up as a duck-themed manifesto, but yes. All of the above constitutes CyDuck's complete data handling policy. There are no additional terms buried in a PDF somewhere. No "we may share data with trusted partners" buried in clause 11.3.b. The whole thing is right here, written in plain language, with emoji.
What about the passphrase word API?
When you click "Generate" on the passphrase page, a request is sent to a third-party random word API asking for N random words. The request contains: the number of words you want. That's it. No IP forwarding headers are added by us. The API is a commodity service used by millions of developers. If it's unavailable, a local fallback word list built into the page is used instead — no network request at all.
Can I trust a website with a duck for a mascot?
Ducks are actually quite trustworthy. They mind their own business, they float well under pressure, and they've never once been caught selling user data to an ad network. The duck was chosen deliberately. It's a reminder that serious tools don't have to take themselves too seriously.
