Referrer-Policy & Origin Leakage Simulator
Every time a user clicks a link, the browser may send the full source URL — including
session tokens, emails, and search queries — to the destination. This tool simulates all
eight Referrer-Policy values and shows exactly what leaks, flagging
sensitive query parameters.
Tool interface
Leakage Analysis
| Policy | Leaked Referer | Exposure |
|---|
Introduction
The Referer header is one of the web's quietest privacy leaks. Depending
on the Referrer-Policy, a navigation can reveal the entire source URL —
path and query string included. This simulator applies the W3C algorithm to your exact
URLs so you can see the exposure before choosing a policy.
How It Works
- The source and destination URLs are parsed to determine origin relationship and downgrade status.
- Each of the 8 policies is applied per the W3C Referrer Policy specification.
- The resulting Referer string is shown for every policy.
- The source URL's query parameters are scanned for sensitive names (token, session, email, etc.) and flagged when leaked.
Privacy
This tool performs pure spec-based simulation in your browser. No requests are made and no data is transmitted.
Limitations
- Simulates the algorithm; does not intercept real network traffic.
- Sensitive-parameter detection is based on common key names and may miss custom ones.
- Does not account for the
referrerpolicyattribute on individual links, only the document-level policy.
FAQ
What is the default Referrer-Policy?
Modern browsers default to strict-origin-when-cross-origin: full URL for same-origin, origin-only for cross-origin, and nothing on downgrade.
How do I stop leaking query parameters?
Set Referrer-Policy: no-referrer or strict-origin so only the origin (or nothing) is sent. Avoid unsafe-url. Better yet, never put secrets in URLs.
Is my data uploaded?
No. Everything is simulated locally in your browser. Nothing is transmitted.