Privacy & Data Handling

What this service stores, what it does not, and how to check a hash without telling us the hash. Written to be specific enough to verify rather than vague enough to be safe.

Effective 21 August 2026 · operator: Red Hacker Ai, Inc., a Florida corporation (United States)

What we never store

When you submit a hash for lookup, it is used to search the index and then discarded. It is not written to disk, not logged in the activity feed, and not retained in any form.

The live activity feed on the home page — the one showing lookups per minute — records exactly three things per lookup: which algorithm, how many milliseconds it took, and whether a match was found. No hash, no plaintext, no client identifier. The function that writes it takes no hash as an argument, so it could not record one even by mistake.

What we do store, and why

Words you type into the compute tab

Two controls limit the damage this can do:

• A word is only added once two different people have independently typed it. A password unique to you, submitted once, is quarantined and never promoted. Junk is, by definition, the thing nobody else independently types.
• We do not store who submitted anything. Counting "two different people" without keeping identities is done by reducing each submitter to an 8-byte HMAC of their IP address under a 32-byte random salt generated on the server. The salt never leaves the machine and is never transmitted. The digest is not reversible to an IP address, and it is not stored alongside the word.

Aggregate counters

We count page hits and unique visitors. Uniqueness uses the same HMAC-of-IP-under-a-local-salt construction described above — a count, not a record of who visited. There is no per-visitor history and nothing that can be joined back to a person.

Rate-limit state

To stop abuse we track request counts per client in memory, keyed by IP address, over a rolling one-minute and one-day window. This is never written to disk and is discarded when the service restarts.

The zero-disclosure option

You send a prefix. We return every stored hash prefix that begins with those six characters — roughly 381 of them — and your own tooling finishes the comparison locally. We are never told which one you were interested in, so the privacy guarantee here is structural, not a promise you have to take on trust. Modelled on the approach Have I Been Pwned uses.

$ curl https://redhacker.ai/api/range/md5/25f9e7
94323B4538
A1C0DE4471
...

# your six characters name a bucket of ~381 candidates.
# which of them you cared about never leaves your machine.

Supported algorithms are md5, sha1, sha256 and ntlm. Responses contain hash prefixes only — never plaintext — are cacheable for a week, and require no CAPTCHA or account so they work from a script. Because six hex characters describe a large bucket rather than one hash, the request path is safe to appear in an ordinary web log.

The MCP connector

mcp.redhacker.ai exposes lookups as tools an AI assistant can call. It is a separate service from the website, and its data handling is narrower:

• No account, no API key, no OAuth. Nothing identifies you to us, because there is nothing to identify you with.
• Hashes are not stored. Same rule as the website: a digest is used to search the index and discarded.
• No analytics on that hostname. Cloudflare Web Analytics runs on the website only. The connector serves JSON-RPC to machines and injects no script.
• No conversation data. The tools receive the arguments your assistant passes — a hash, an algorithm name, a prefix — and nothing else. We do not receive, request, or have any way to reach your chat history, files, or anything else in your assistant.
• Rate-limit state only. A connection identifier and a count of recent requests, held in memory and discarded when the window passes. It is not written to disk and cannot be linked to a person.
• It refuses identities. Email addresses, usernames and phone numbers are rejected before any lookup happens — enforced in code, not policy.

The check_hash_prefix tool is the zero-disclosure path, and it is the one to prefer when the hash is not yours: we cannot disclose what we were never sent.

Logs and infrastructure

Being straightforward about this, because "we don't log anything" is almost never true:

Processing happens on infrastructure the operator controls, located in the United States.

Analytics

This site runs Cloudflare Web Analytics. It is the only analytics tool here, and it exists so we can see whether the site is being used and whether it is fast — not to build a picture of you.

It works differently from the analytics you are probably used to:

• No cookies, and nothing stored in your browser. It does not need your consent under a cookie banner because it sets nothing to consent to.
• No fingerprinting — it does not attempt to identify a device or re-identify a returning visitor.
• No cross-site tracking. The data is scoped to redhacker.ai. It cannot tell where you went next, and Cloudflare does not join it to your activity on other sites.
• It reports in aggregate: page views, referrer, country, browser and operating system, and page-load timings.

Mechanically, Cloudflare injects a small script from static.cloudflareinsights.com which reports measurements to cloudflareinsights.com. Both are named explicitly in this site's Content-Security-Policy, so you can confirm exactly what is permitted to run by reading the content-security-policy response header — nothing else can execute or phone home.

If you would rather not be counted, any content blocker that blocks cloudflareinsights.com will stop it, and the site works normally without it. Using the range API instead of the web interface avoids it entirely.

Data retention

Third parties

We do not sell, rent, trade or share your data with anyone. There is no advertising, there are no data brokers, and there are no marketing tools on this site.

Two service providers necessarily process request data in order to deliver the site, and they are the complete list:

Everything else — the index, the lookup service and the MCP connector — runs on hardware the operator owns and controls, in the United States. Nothing is subcontracted to a hosting provider or a third-party API.

What we do not do

• No accounts, no sign-in, no email collection.
• No advertising, no ad networks, and no data brokers.
• No cross-site tracking. The one analytics tool we run cannot follow you to another site — see Analytics.
• No cookies used for tracking or profiling.
• No selling, renting, or sharing of data. There is nothing to sell.
• No building of per-person query histories. The data model has no place to put one.

Removing a word from the corpus

If a word that identifies you personally has ended up in the corpus, write to [email protected] and it will be removed. Note that the corpus is largely built from wordlists of already-breached passwords published elsewhere — removing an entry here does not remove it from the breach data it came from, and a password that appears in a public breach corpus should be treated as burned regardless.

Intended use

This is a password-auditing and security-research tool. Submit only hashes you own or are authorised to test. Automated and bulk use is rate-limited and may be blocked. Salted hashes — bcrypt, scrypt, Argon2 — are immune to this technique by design, which is the point: if your hashes can be reversed here, the fix is a salted adaptive hash, not secrecy.

Contact and changes

Privacy or security questions: [email protected]. Vulnerability reports are welcome at the same address; see /.well-known/security.txt.

If this page changes in a way that affects what is collected, the effective date above changes with it.