What kinds of tracking does this detect?

It flags known marketing parameters (utm_*, fbclid, gclid, mc_eid and many more), query keys that look like user, session, or email identifiers, long hex or base64 tokens that resemble hashes, and path segments shaped like UUIDs or numeric IDs.

Does it remove tracking automatically?

It produces a cleaned URL with the known tracking parameters stripped while preserving the parameters a page genuinely needs. You should still review the result, since some apps encode functional data in parameters that happen to look like tracking.

Why are hashes in a URL a privacy risk?

A 32-character hex string is often an MD5 hash and a 64-character hex string an SHA-256 hash. Marketers sometimes hash an email address and pass it in a link so that a click can be tied back to a known person, which defeats the apparent anonymity of a hashed value.

Is the URL sent to a server?

No. The link is parsed entirely in your browser with the built-in URL API and a set of local pattern rules. Nothing is fetched and nothing is transmitted, so you can safely check sensitive links.

Why flag UUIDs in the path?

A UUID or long numeric segment in the path frequently identifies a specific user, account, or invite. Sharing such a link can grant access or reveal who the link was generated for, so it is worth a second look before posting publicly.

URL Privacy & Fingerprinting Risk Checker

A link can carry far more than the page address. Marketing platforms append tracking parameters, share links sometimes embed a user or invite ID, and some campaigns smuggle a hashed email into the query string so a click ties back to a named person. Before you post a link publicly or hand it to a source, this checker parses it locally, flags the privacy-risk signals by category, and hands back a cleaned version with known trackers stripped. Nothing is fetched and nothing leaves your browser.

How it works

The tool uses the browser’s built-in URL parser and then runs a set of pattern rules over the components:

Tracking parameters — the query keys are matched against a known list (utm_source, utm_medium, utm_campaign, fbclid, gclid, gbraid, wbraid, mc_eid, igshid, ref, and others).
Identifier-shaped query keys — keys containing id, uid, user, session, token, or email are flagged as potentially identifying.
Hash-shaped values — any value that is a 32-character hex (MD5), 40-character hex (SHA-1), or 64-character hex (SHA-256) string is flagged, since hashed emails are a common tracking trick.
Path identifiers — path segments matching a UUID pattern or a long numeric run are flagged as user/resource identifiers.

Each category that fires adds to a risk total, which is bucketed into Low / Medium / High.

The cleaned URL

The tool rebuilds the URL keeping the scheme, host, and path, but drops every query parameter on the known-tracker list. Functional parameters that are not on that list are preserved, because removing them could break the page.

Example

https://shop.example.com/p/9f1c?utm_source=newsletter&utm_campaign=spring&uid=84213 is flagged for two tracking parameters and one ID-shaped key, rated Medium, and cleaned to https://shop.example.com/p/9f1c?uid=84213 — note that uid is preserved because it is not on the tracker list, but it is still flagged for your review.

Notes

Treat the cleaned link as a starting point, not a guarantee — some apps encode functional state in parameters that resemble trackers. The check is heuristic and runs entirely on your device.