Skip to content
OnlineHashCrack

Trust Center

How OnlineHashCrack protects the service, handles customer data and supports responsible security research.

OnlineHashCrack processes hashes and encrypted files for password recovery and authorized security testing. The safeguards below describe the controls and handling practices published for this service. They are not a certification or a substitute for your organization's assessment.

Platform security

  • Encrypted connections: HTTPS protects data in transit. The server supports TLS 1.3 and post-quantum cryptography (PQC) key exchange for compatible clients.
  • Network protection: Cloudflare provides DNS protection and DDoS mitigation.
  • Maintenance: regular patching, automated security scanning and vulnerability assessments support ongoing risk reduction.
  • Short-lived processing: password recovery jobs run in isolated, short-lived containers that are terminated after completion.
  • Limited email exposure: task notifications show only a masked excerpt rather than the full details.
  • Vulnerability disclosure: see our Coordinated Vulnerability Disclosure Policy.

View the current SSL Labs assessment

Privacy and data handling

  • Purpose and minimization: information is collected to provide the service you request.
  • Data residency: OHC states that its service data is hosted and processed within the European Union.
  • Retention: account data, hashes and recovered outputs are retained according to the periods described in the Privacy Policy; uploaded source files are deleted after hash extraction.
  • Account deletion: accounts inactive for 12 months are permanently deleted with associated data; unverified accounts are deleted after 7 days.
  • Cookie choices: the consent banner lets visitors accept or reject Analytics, with a permanent control to change that choice.
  • Privacy rights: the Privacy Policy explains applicable access, correction, deletion, portability, objection and opt-out rights.
  • Personal information is not sold or shared for third-party advertising or profiling.

Email authentication

Email sent from @onlinehashcrack.com uses sender authentication to reduce spoofing and phishing:

  • SPF - Sender Policy Framework.
  • DKIM - outgoing messages are signed.
  • DMARC - policy set to reject unauthenticated messages.

If you receive a suspicious message claiming to be from OHC, forward it to [email protected].

Payment security

  • Stripe processes card and wallet payments.
  • OnlineHashCrack does not store your card data on its servers.
  • Checkout uses encrypted connections to protect payment information in transit.

Browser security headers

The website configures browser-enforced headers to require secure connections and help prevent unauthorized framing. Verify the current response independently with SecurityHeaders.com .

HSTS
HTTP Strict Transport Security is configured with a long max-age to instruct browsers to use HTTPS on future visits.
X-Frame-Options
Blocks pages from being displayed in frames.
Content-Security-Policy
Defines a frame-ancestors policy that blocks embedding.

Questions about security, privacy or a legal request?

Contact OnlineHashCrack