RandoziURL Sensitive Parameter Checker
Before you paste a link in a chat or a ticket, see what it carries. Every parameter is listed, the ones that look like secrets are flagged, and you get a copy of the URL with their values replaced by ***.
Possibly sensitive
2 of 5
URL to share (values hidden)
https://app.example.com/callback?code=***&state=abc&email=***&page=2&utm_source=newsletter
| Parameter | Where | Value | Verdict |
|---|---|---|---|
| code | query | Xk29fa | Possibly sensitive: the name matches "code" |
| state | query | abc | Nothing found |
| query | ann@example.com | Possibly sensitive: the name matches "email" | |
| page | query | 2 | Nothing found |
| utm_source | query | newsletter | Nothing found |
This is a heuristic, not a guarantee. It looks at parameter names and at the shape of values (an email, a JWT, a long random string). A secret in a parameter with an ordinary name, or in the path of the URL, is not detected. Read the masked URL yourself before you share it.
How it works
- Paste the URL, or just its query string.
- Read the flagged parameters and the reason for each.
- Edit the list of words at the bottom if your site uses other names, or tick “Hide every value”.
- Copy the masked URL, and read it yourself before you share it.
What people use it for
Support tickets and chats
Share a failing link without leaking a session id or a login token.
Bug reports and screenshots
Mask the address of a page before you post it in an issue or a forum.
Reviewing your own links
Spot a link that puts an email address or a key in the query string, where logs and referrers can copy it.
Questions
- How does it decide that a parameter is sensitive?
- Two rules. First, the name: it is cut into words (accessToken becomes access and token) and compared with the list you can see and edit, so “key” matches api_key but not “monkey”, and long words such as “token” also match “csrftoken”. Second, the value: an email address, a JWT (eyJ…), or a 32+ character random-looking string is flagged whatever the name. Credentials before the @ of the address and parameters after # are checked too.
- Is the masked URL safe to share?
- Not guaranteed. This is a heuristic. A secret in a parameter with an ordinary name, in the path (/reset/abc123), or in a name that is not in the list is not detected. Read the masked URL before you share it, and treat anything it still shows as public.
- What exactly is replaced by ***?
- Only the value of a flagged parameter that has one, and the user and password before an @. The rest of the URL is kept as typed. “Hide every value” replaces all non-empty values, which is the safer choice.
- Is the URL sent anywhere?
- No. The check runs in your browser and nothing you type is uploaded, stored or added to a link. The input is limited to 20,000 characters and 2,000 parameters.