Privacy

The short version

• No ads, no analytics, no tracking scripts. Every tool works without an account.
• Nothing you paste is logged.
• Most tools run entirely in your browser. Something leaves your device only when you press Check reputation or Check domain.
• We set a cookie only when you use something that needs it: a lookup or domain check, or signing in.
• An account is optional. It holds your email address, the domains you save, the products you watch and your alerts, and you can delete it yourself at any time.

Accounts and alerts (optional)

You only need an account to save domains and get alerts about them. Signing in works with a one-time link or code sent to your email address; there's no password. If you have an account, we store:

• Your email address, used only for sign-in links and the alert emails you allow.
• The domains you save (up to 5), a random verification code for each, and the latest daily result: the grade, each check's status, the certificate's expiry date, and any lookalike domains found with a website or mail (the name, which of the two it has, and when we first saw it).
• The vendors and products you watch on the Intel tab (up to 25). Once an hour our server compares them with newly listed exploited vulnerabilities; nothing about your watchlist is sent to anyone else.
• Your alerts (for example "grade dropped from A to C"), kept for 180 days so you can see them on the Alerts tab.
• Push subscriptions, if you turn on notifications: the address your browser's push service gave this device, and the keys used to encrypt notifications for it.
• Your sign-in session: a random token that lasts 30 days, renewed while you use it. We don't store your IP address or browser details with it. Sign-in links and codes work once, expire after 15 minutes, and are stored only as a one-way hash. A code stops working after 3 wrong tries.

This is kept in Cloudflare's D1 database. Delete account in Settings erases all of it straight away.

Daily checks. Once you prove you control a saved domain (with a DNS TXT record), our server runs the same domain check described below on it once a day, and compares the result with the day before. It also looks up about 120 lookalike names (typos, look-alike characters and other endings, such as examp1e.com or example.net) in public DNS through Cloudflare's 1.1.1.1, to see which have a website or mail. It doesn't visit them.

Who helps deliver alerts. Emails (sign-in links and codes, and alerts when push isn't available) are sent through Resend, which receives your address and the email's text (Resend's privacy policy). Push notifications travel through your browser's push service (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, Microsoft for older Edge). They're encrypted for your device, so the push service can't read them.

What stays in your browser

Indicator detection and bulk extraction (including CSV and STIX exports), the JWT, base64 and URL decoders, and the email header analyzer run on your device. What you paste into them is never sent to us or anyone else.

Phishing triage reads the message you paste or the .eml file you choose, including its body and attachments, only in your browser. They're never sent to us or anyone else, and the message is only parsed: its links aren't visited, its images and other content aren't loaded, and its attachments aren't opened. As with the bulk view, only the indicators you choose to check are sent, when you press Check reputation.

The About page loads a short service-status summary from our server, and the Intel tab loads its list of exploited vulnerabilities. Neither request carries anything you've typed.

On the Intel tab, searching the list happens in your browser.

Reputation lookups

When you press Check reputation, your browser sends that indicator (an IP address, domain, URL or file hash) to our server. From the bulk view, it sends the listed indicators you chose to check, up to 50 at a time. The server asks these sources about each one, depending on its type:

• abuse.ch: URLhaus, ThreatFox and MalwareBazaar (their privacy policy)
• Google Safe Browsing, for URLs and domains only (Google's privacy policy)

Those services receive the indicator from our server, not from your browser, and don't receive your IP address from us.

Your own API keys (optional)

In Settings you can add your own keys for VirusTotal, AbuseIPDB, GreyNoise and AlienVault OTX. They're stored only in your browser (in its IndexedDB storage), never in our database. Remove them in Settings, or by clearing this site's data. When you press Check reputation with keys saved:

• AlienVault OTX: your browser sends the indicator and your key straight to OTX, so it sees your IP address. We don't see this request (OTX's privacy policy).
• VirusTotal, AbuseIPDB and GreyNoise don't accept requests from web pages, so your browser sends the indicator and your key to our server, which passes them on and returns the answer. Neither is logged, stored or cached, and the answer isn't shown to anyone else. The provider sees the request coming from Cloudflare's network, not from you (VirusTotal, AbuseIPDB and GreyNoise privacy policies).

Each provider's own terms apply to how you use your key.

Domain checks

When you press Check domain, your browser sends that domain name to our server. The server then:

• reads the domain's public DNS records through Cloudflare's 1.1.1.1 resolver;
• requests the site's home page over HTTPS and over plain HTTP, following at most 3 redirects and identifying itself as Bluebench. The site sees requests from Cloudflare's network, not from you;
• looks up the domain's certificates on crt.sh, run by Sectigo (Sectigo's privacy policy), or, when crt.sh is down, on SSLMate's Cert Spotter (SSLMate's privacy policy).

It never scans ports or crawls beyond the home page.

Report links. Every report has its own link (bluebench.dev/domain-checker/ and the domain), so you can share it. Opening one runs the same check, as if you'd typed the domain in. Anyone with the link can do that, since domain checks only use public information. These pages ask search engines not to list them, and we don't keep a list of which domains were checked or shared.

Grade badges. If you turn on the badge for a domain you've verified, its grade from the daily check becomes public at bluebench.dev/api/badge/ and the domain name, for anyone to see or embed. Only the grade letter is shown. It's off until you turn it on, and turning it off (or removing the domain) hides it again; copies already fetched may be cached for up to an hour.

What we store, and for how long

• Cached results, so repeat lookups don't hit the sources again: kept for up to 24 hours (Safe Browsing results only as long as Google allows). They're filed under a one-way hash of the indicator, and the indicator itself is removed from the stored result.
• Domain reports: kept for an hour, and certificate results for a day, so repeat checks don't hit the site or the certificate services again. They're filed under a one-way hash, and the domain name is removed from what's stored.
• Daily counters for lookups, domain checks and sign-in emails, for fair-use limits: a count per session, per account, per email address and per network address, stored only as keyed one-way hashes and deleted after the day ends (UTC).
• Per-minute rate limits: Cloudflare's rate-limiting service briefly sees your IP address (for IPv6, your /64 network) to stop floods.

We don't keep request logs. The site is hosted on Cloudflare, which processes IP addresses to deliver and protect it under the Cloudflare privacy policy.

Bot check (Cloudflare Turnstile)

To keep the free lookups free, your first lookup runs an invisible bot check from Cloudflare Turnstile, loaded from challenges.cloudflare.com. It isn't loaded until then. Turnstile processes signals such as your IP address, TLS fingerprint and browser User-Agent to tell people from bots, and Cloudflare also uses them to improve its bot detection. Cloudflare says these signals aren't used to identify, profile or target you. See the Cloudflare Turnstile Privacy Addendum.

Cookies and local storage

After the bot check we set __Host-bb_session: a random, signed session ID that expires after 24 hours. It's needed for lookups and domain checks to work and isn't used for anything else.

If you sign in, we also set __Secure-bb.session_token, which keeps you signed in for up to 30 days, and the app remembers in your browser's local storage that you're signed in (bb.signedIn), so it only asks our server about your account when you have one. For 15 minutes after you ask for a sign-in email, it also keeps the address it went to (bb.pendingSignIn), so the code box is still there if your phone reloads the app while you check your email.

If you add your own API keys, they're kept in an IndexedDB database named bluebench in your browser, and nowhere else.

The app also caches its own files on your device so it works offline and can be installed, along with the Intel tab's public list of exploited vulnerabilities, so it opens instantly.

Questions and requests

Email privacy@bluebench.dev. Without an account we hold nothing that identifies you, as we keep no logs. With one, we hold only what's listed above, and we'll send you a copy if you ask. We'll answer any question about your data, including on Cloudflare Turnstile's processing for this site.

Changes

If what we collect or who we share it with changes, we'll update this page before the change goes live and change the date at the top.