everything in a file that you did not put there. invisible characters, tracking tags, buried metadata. it shows you what it found before it takes anything out.
this page collects nothing. every byte stays in your browser. no upload, no server, no account. save the file and it works with the wifi off.
invisible characters, spaces that are not spaces, letters that are not the letters they look like. and when the hidden things fall in a pattern, it reads them.
a photograph carries the camera, the software, the date, and often the exact place it was taken. all of that travels with it into every message and upload.
every link you share carries passengers. campaign tags, click ids, affiliate codes, and sometimes the name of the person it was sent to. take them off and the link still works, but it stops telling anyone who sent it or where you got it.
paste anything written to move you. a pitch, a dm, a launch email, a sales page. it names the pressure in it and quotes the line. works just as well on something you are about to send.
the three tools above work on things you paste in. this one works on whole websites. it opens a panel listing who the page contacted, what is recording you, what is stored on you, and every bit of pressure built into it.
click below and check any page you find. you might be surprised what it shows. (including this one).
to use it on other sites it has to live in your bookmarks.
on a phone, probably better to skip. this one is more of a desktop goodie.
a page that trusted you would not need to watch you. every one of these works for someone. none of them work for you.
then point it at your own site.
almost nobody running a business has seen what their own pages load. you add one analytics snippet, the theme brings eleven friends along, and somewhere in there is usually a session recorder watching your customers move their mouse. they were never told, because you were never told either.
you can switch any of it off. you have to see it first.
it runs in your browser, on the page you already loaded. it sends nothing, it stores nothing, and it works on sites you are signed into, which is where the interesting parts usually are. some sites block bookmarklets with a strict content policy and it will simply not open there. presence of a tracker is not proof of anything, but nobody told you either way, and that is the part worth noticing.
(function(){
if(document.getElementById('f7r-panel')){document.getElementById('f7r-panel').remove();return}
var T={'google-analytics':'google analytics','googletagmanager':'google tag manager',
'doubleclick':'google ads','connect.facebook':'meta pixel','facebook.net':'meta pixel',
'analytics.tiktok':'tiktok pixel','hotjar':'hotjar · records your mouse and scrolling',
'clarity.ms':'microsoft clarity · records your session','fullstory':'fullstory · records your session',
'logrocket':'logrocket · records your session','smartlook':'smartlook · records your session',
'mouseflow':'mouseflow · records your session','inspectlet':'inspectlet · records your session',
'segment.com':'segment','segment.io':'segment','mixpanel':'mixpanel','amplitude':'amplitude',
'heap.io':'heap','matomo':'matomo','plausible':'plausible · privacy friendly',
'intercom':'intercom','drift.com':'drift','hubspot':'hubspot','marketo':'marketo',
'klaviyo':'klaviyo','mailchimp':'mailchimp','criteo':'criteo · retargeting',
'taboola':'taboola · content ads','outbrain':'outbrain · content ads',
'snap.com':'snap pixel','pinterest':'pinterest tag','licdn.com':'linkedin insight',
'fingerprintjs':'fingerprintjs · identifies you across sites','optimizely':'optimizely · a/b testing',
'vwo.com':'vwo · a/b testing','sentry':'sentry · error tracking','bugsnag':'bugsnag · error tracking'};
var here=location.hostname.replace(/^www\./,''),hosts={},found={},third=0;
(performance.getEntriesByType('resource')||[]).forEach(function(r){
var h;try{h=new URL(r.name).hostname}catch(e){return}
if(!h||h.replace(/^www\./,'')===here||h.indexOf(here)>-1)return;
if(!hosts[h]){hosts[h]=1;third++}
for(var k in T)if(r.name.indexOf(k)>-1)found[T[k]]=1;
});
var ck=document.cookie?document.cookie.split(';').filter(function(x){return x.trim()}).length:0;
var ls=0,ss=0;try{ls=localStorage.length;ss=sessionStorage.length}catch(e){}
var txt=(document.body.innerText||'').slice(0,200000);
var zw=(txt.match(/[]/g)||[]).length;
var urg=[];
if(/\b\d{1,2}\s*:\s*\d{2}\s*(:\s*\d{2})?\b/.test(txt)&&/(ends|expires|left|remaining|hurry|last chance)/i.test(txt))urg.push('a countdown');
var sc=txt.match(/only\s+\d+\s+(left|remaining|spots?|seats?)|\d+\s+(people|others)\s+(are\s+)?(viewing|watching|looking)|\d+\s+spots?\s+(left|remaining)/gi);
if(sc)urg.push('scarcity copy · "'+sc[0].trim().slice(0,42)+'"');
var au=0;[].forEach.call(document.querySelectorAll('video,audio'),function(m){if(m.autoplay)au++});
if(au)urg.push(au+' thing'+(au>1?'s':'')+' set to play on its own');
var pre=0;[].forEach.call(document.querySelectorAll('input[type=checkbox]'),function(c){
if(c.checked&&/news|market|offer|email|subscri|consent|partner/i.test((c.name||'')+(c.id||'')+(c.className||'')))pre++});
if(pre)urg.push(pre+' opt-in already ticked for you');
var nn=Object.keys(found).length;
var verdict = nn===0&&third===0?'this page talked to nobody but itself. that is rare.'
: nn===0?'nothing named. '+third+' other domain'+(third>1?'s':'')+' were contacted and some of those will be its own.'
: nn<=2?nn+' known watcher'+(nn>1?'s':'')+' on this page.'
: nn<=5?nn+' known watchers. that is a normal day now, which is the point.'
: 'this page brought a crowd. '+nn+' known watchers.';
var A='#E89B3F',B='#0B0A08',C='#F0EBE0',M='#8A877F',D='#5A5852';
function rows(o){var s='';for(var k in o)s+='<div style="display:flex;justify-content:space-between;gap:12px;padding:5px 0;border-bottom:1px solid rgba(240,235,224,.07)"><span style="color:'+C+'">'+k+'</span></div>';return s}
var p=document.createElement('div');p.id='f7r-panel';
p.setAttribute('style','all:initial;position:fixed;top:16px;right:16px;width:370px;max-height:82vh;overflow:auto;z-index:2147483647;background:'+B+';color:'+C+';border:1px solid rgba(232,155,63,.45);padding:18px;font:13px/1.6 ui-monospace,SFMono-Regular,Menlo,monospace;box-shadow:0 18px 60px rgba(0,0,0,.6)');
p.innerHTML='<div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:12px">'
+'<span style="color:'+A+';letter-spacing:.1em;font-size:11px">WHAT THIS PAGE IS DOING</span>'
+'<span id="f7rx" style="color:'+D+';cursor:pointer;font-size:16px;line-height:1">×</span></div>'
+'<div style="color:'+C+';margin-bottom:14px;font-size:14px">'+verdict+'</div>'
+'<div style="display:flex;gap:16px;margin-bottom:14px;color:'+M+';font-size:12px">'
+'<span><b style="color:'+A+';font-weight:400">'+nn+'</b> named</span>'
+'<span><b style="color:'+A+';font-weight:400">'+third+'</b> domains</span>'
+'<span><b style="color:'+A+';font-weight:400">'+ck+'</b> cookies</span>'
+'<span><b style="color:'+A+';font-weight:400">'+(ls+ss)+'</b> stored</span></div>'
+(Object.keys(found).length?'<div style="color:'+D+';font-size:10px;letter-spacing:.14em;margin:14px 0 6px">NAMED</div>'+rows(found):'')
+(urg.length?'<div style="color:'+D+';font-size:10px;letter-spacing:.14em;margin:14px 0 6px">PRESSURE</div>'+urg.map(function(u){return '<div style="color:'+A+';padding:5px 0;border-bottom:1px solid rgba(240,235,224,.07)">'+u+'</div>'}).join(''):'')
+(zw?'<div style="color:'+D+';font-size:10px;letter-spacing:.14em;margin:14px 0 6px">INVISIBLE</div><div style="color:'+A+';padding:5px 0">'+zw+' zero-width characters in the visible text</div>':'')
+'<div style="color:'+D+';font-size:10px;letter-spacing:.14em;margin:14px 0 6px">DOMAINS CONTACTED</div>'
+'<div style="color:'+M+';font-size:11.5px;line-height:1.7;word-break:break-all">'+(third?Object.keys(hosts).sort().map(function(x){return x.replace(/[&<>]/g,'')}).join(' · '):'none')+'</div>'
+'<div style="color:'+D+';font-size:11px;margin-top:16px;line-height:1.65">counted from what loaded before you clicked, so a page still behind a cookie banner has not fired most of it yet. some of those domains are the site\'s own cdn and this cannot always tell which. presence is not proof of misuse, but nobody told you either way.<br><a href="https://www.frank7.dev/noise" style="color:'+A+';text-decoration:none">frank7.dev/noise</a></div>';
document.body.appendChild(p);
document.getElementById('f7rx').onclick=function(){p.remove()};
})();