Check URL privacy before sharing a link

How-to Last tested 24 October 2026

Treat a reset, invitation or signed URL as potentially confidential before pasting it into an online inspection service. Check what the service receives, who can view submissions and whether a lookup starts a new request; a hostname-only note can support a discussion, but it is different evidence from the original URL.

Identify what the address contains

A link can carry information in more places than a parameter named token. User information can precede the hostname. A tenant, customer or internal project can appear in a subdomain. The path may contain a document identifier, while the query or fragment can contain a secret or account-specific state.

For that reason, deleting one obvious parameter is not a general privacy procedure. Read the entire structure first. The local inspector separates those fields without sending them to a remote analysis service, but its output may still contain the same confidential material. Local processing does not make a screenshot suitable for public sharing.

Password-reset flows illustrate why the context matters. OWASP recommends controls around reset tokens, including limited validity and protection against leakage.¹ The token is part of an account workflow, not an ordinary public search term. An inspection service’s ability to request the address does not establish that it should receive the token.

Separate lookup, submission and visibility

An existing-report lookup and a new scan can be different operations. Read the action’s documentation instead of relying on a familiar search-box shape. If the documentation is unclear, record the operation as unknown rather than assuming that no visit or new report will occur.

Visibility is a separate question. A public report, a report omitted from a public search and a report restricted to an account are not interchangeable descriptions. For example, urlscan documents distinct visibility modes with different audiences.² Preserve the mode’s definition and the product tier or account context to which it applies.

The policy comparison keeps submission visibility, retention, third-party sharing, account requirements and private-scan options in separate fields. It does not fill a missing submitted-URL retention rule with an unrelated account-data retention statement. An unknown cell is a reason to resolve that question before disclosure, not proof that the service stores nothing.

A complete hostname-only note maker

This example illustrates minimization for a discussion. It preserves the parsed hostname and omits user information, port, path, query and fragment. It does not produce a replacement URL for a scan and does not decide whether the remaining hostname is confidential.

<!doctype html>
<!-- SPDX-License-Identifier: MIT -->
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Make a hostname-only discussion note</title>
    <style>
      body { font: 1rem/1.5 system-ui; margin: 2rem; max-width: 44rem; }
      label, textarea, select { display: block; margin-block: .75rem; }
      textarea { width: 100%; min-height: 5rem; }
      button { padding: .5rem 1rem; margin: .5rem .5rem .5rem 0; }
      pre { white-space: pre-wrap; overflow-wrap: anywhere; }
      :focus-visible { outline: 3px solid #16624c; outline-offset: 3px; }
    </style>
  </head>
  <body>
    <h1>Make a hostname-only discussion note</h1>
    <p>This removes URL fields; it does not make a sensitive hostname anonymous.</p>
    <label for="address">Synthetic HTTP or HTTPS URL</label>
    <textarea id="address" spellcheck="false" autocomplete="off">https://member:[email protected]/reset/example-only?token=example-only#private-note</textarea>
    <button id="reduce" type="button">Make text note</button>
    <button id="clear" type="button">Clear</button>
    <p id="message" role="status"></p>
    <pre id="note" aria-label="Hostname-only note"></pre>
    <script>
      const address = document.querySelector("#address");
      const note = document.querySelector("#note");
      const message = document.querySelector("#message");
      function reduce() {
        note.textContent = "";
        try {
          const parsed = new URL(address.value);
          if (!["http:", "https:"].includes(parsed.protocol)) {
            throw new Error("Unsupported scheme");
          }
          note.textContent = [
            "Hostname only: " + parsed.hostname,
            "User information, port, path, query and fragment omitted.",
            "This is not the original address and must not be used as a scan substitute."
          ].join("\n");
          message.textContent = "Check the hostname itself for confidential labels before sharing.";
        } catch {
          message.textContent = "Enter an absolute HTTP or HTTPS URL.";
        }
      }
      document.querySelector("#reduce").addEventListener("click", reduce);
      document.querySelector("#clear").addEventListener("click", () => {
        address.value = "";
        note.textContent = "";
        message.textContent = "Input and note cleared.";
        address.focus();
      });
      reduce();
    </script>
  </body>
</html>

Case one: a reset path and token

The initial synthetic address contains user information, a reset path, a query token and a fragment. After choosing Make text note, the output contains portal.example.test and an explicit statement of what was omitted. None of the removed field values are copied into the note.

The demo leaves the original input visible until Clear is used. That is intentional: you can compare the reduction with the source string before deciding what to do with it. If you take a screenshot of the entire page, the input remains part of the screenshot. Minimizing an output is not the same as clearing every visible copy.

Use a synthetic address when explaining the pattern to another person. Replacing a real token with the words example-only communicates the location of a field without exposing its value. Keep the distinction explicit so that nobody mistakes the example for an actionable link.

Case two: the hostname is sensitive too

For https://private-client.example.test/file, the note still contains private-client.example.test. That is the correct result for this component: it retains the hostname by design. It cannot know whether a label is a customer’s name, an internal environment or a harmless public string.

If the host itself is confidential, do not share the note. Replace the entire address with a reserved example when the conversation only concerns URL structure. If a real provider needs an exact address for a legitimate investigation, use the appropriate private process under the permissions that apply to that information. The component does not make that decision for you.

This limitation is also why there is no green success state saying that the note is anonymous. Removing fields can reduce disclosure, but it cannot infer the meaning of every remaining label. The status message asks the reader to check the hostname itself.

Case three: invalid input

The code first empties the output. If the address cannot be parsed as an absolute HTTP or HTTPS URL³, it displays an explanation and leaves the note blank. An earlier hostname cannot remain beneath a new malformed input and accidentally become the thing someone copies.

No base URL is supplied and no missing scheme is guessed. These choices keep the output tied to a declared input. A fragment or relative path on its own may be meaningful inside a particular application, but this small standalone example does not know that application’s context.

Every generated line uses textContent.⁴ The note is never assigned to a link or submitted through a form. Clear empties the textarea and note, changes the status text and returns focus. The code does not read or write the clipboard automatically.

Keep redaction separate from evidence

A report about a hostname does not automatically cover every path and query under it. Likewise, a scan of a shortened or edited address does not establish what the original signed link would have returned. If you remove fields before discussing a result, record that change so the two addresses are not treated as identical evidence.

When documenting an issue, distinguish the private original, the reduced discussion note and any synthetic teaching example. Keep their purposes separate. A colleague reading a hostname-only note should know that it lacks the exact resource and cannot reproduce a request to it.

Before using an external service, answer a short set of concrete questions: is this a new submission; can the service request the resource; who can see the resulting record; what sharing is documented; and what retention is stated for this mode? If one of those answers matters and remains unknown, the evidence does not justify treating it as a private operation.

Not covered on this page

• Automatic detection of every confidential URL field.
• Provider-account setup or service submissions.
• Revoking an exposed token or investigating account compromise.
• Legal advice about a particular disclosure.