privacy · email surveillance
100% Free | No Sign-Up RequiredEmail Tracker Detector
Paste the raw source of an email and see what it does behind the text: the invisible one-pixel image that reports when you read it, the links that route through a tracking server before reaching their destination, and the identifier that ties both to your address. 170 named tracking services are recognised by URL, and the score says how much the message can learn about you.
Nothing leaves this tab. Your email is parsed by JavaScript on your device.
No account, no upload, no copy on a server. Paste a message, or load one of the five sample emails, and read the checks as they run.
- transport
- 0 bytes
- storage
- none
- trackers known
- 170 services
- audit
- view-source
message source
local only0 characters · parsed as you type or paste
no file chosen yet · read locally, never uploaded · an Outlook .msg is binary, so save it as .eml or paste its source
Runs entirely in your browser. The email you paste is not stored, sent or logged anywhere.
direct answer
An email tracks you with a one-pixel invisible image whose URL is unique to you: opening the message makes your mail client fetch it, and that request hands the sender the exact time you read it, your IP address (so your rough location) and your device type. Two more signals sit in the same message — click-tracking links that route through the sender's server, and campaign parameters that follow you onto the destination site. To check a message, open its raw source (Gmail: ⋮ → Show original), paste it into the detector above and read the score. It runs on your device, so the email itself is never uploaded.
findings
Every tracking signal in the message
Each signal, its severity, the URL that proves it, and what to do about that specific one. Expand any row.
What to do with this message
- Unsubscribe route
- not advertised
Automated analysis of a message you supply. Not a legal opinion and not a security product.
how it works
How the detector reads an email
Four passes, in order, over the text you paste. Every weight is published, so you can check the score by hand.
1. The message is taken apart first
An email is not HTML — it is a header block followed by one or more encoded parts. The detector unfolds continuation lines, splits multipart/alternative on its boundary, and decodes each part by its Content-Transfer-Encoding: quoted-printable (=3D and soft line breaks) and base64 are both handled, which is why a newsletter that looks empty in the paste still gets parsed. Then the HTML is scanned for images and links — including background-image:url(), Word's v:imagedata and v:fill shapes, which are where Outlook hides its beacons. The text/plain part is read too: it cannot hold a pixel, but it holds the same tracked URLs written out in full, and those are picked up whether or not an HTML alternative exists.
2. An image is a beacon if it behaves like one
An image is scored as a tracking pixel when it is 1×1 or otherwise a few pixels wide, or styled display:none/visibility:hidden/opacity:0, or named like a spacer, and its URL points at a domain that is not the sender's. If that URL matches one of the known tracking endpoints, the service is named; if it matches none, it is still reported — as an unlabelled beacon, which is the more honest finding.
3. Links are checked four ways
Is the link host one of the known click-tracking endpoints? Does the link pass through a tracking path before reaching its destination? Does it carry campaign parameters (utm_source, mc_cid, sms_… and the rest)? And does it carry an identifier that maps the visit to you — in the worst case, your full email address, URL-encoded inside the query string?
4. The headers tell the rest of the story
X-CampaignID, Feedback-ID, X-Smc-Uid and about twenty other fields identify the sending platform even when the body is clean. List-Unsubscribe and List-Unsubscribe-Post say whether a one-click exit is offered, as bulk senders are required to provide. Authentication-Results is read for the SPF, DKIM and DMARC verdicts, and the Return-Path domain is compared with the visible sender — a mismatch there is the classic phishing tell.
How the exposure score is calculated
+ tracked link 20 + campaign parameters 10
+ recipient ID 20 (25 if your address itself is in the URL) + campaign headers 5
→ capped at 100 · bands: 0 = no signals · 1–30 = minimal · 31–60 = tracked · 61–85 = heavily tracked · 86+ = fully profiled
| Signal | Weight | Why it is worth that much |
|---|---|---|
| A hidden or 1×1 image that behaves like a beacon | 30 | Fires on open and reports time, IP and client in one request |
| One named tracking service matched | +15 | A known endpoint means an account, a dashboard and a profile behind it |
| Two or more named services matched | +25 (in place of 15) | Stacked trackers mean a profile, not a one-off count |
| Any link that is wrapped, tagged or carries an identifier | 20 | Your clicks stop being private browsing and start being campaign data |
| Campaign parameters on at least one link | 10 | Follows you to the website and joins the email profile to the web one |
| A per-recipient identifier in a URL | 20 | A stable key: two messages from the same list become one profile |
| Your full address inside a URL | 25 instead of 20 | Readable by any proxy, log and browser history between you and the server |
| Campaign or bulk headers present | 5 | Identifies the sending platform without leaking anything new |
Weights are added once each, not per image or per link, and the total is capped at 100 — the findings list is where the counts live. Penalty findings (SPF, DKIM or DMARC failures, a return path on a different domain) are listed at high severity but add nothing to the tracking score: they are trust signals, not tracking signals.
Where the tracker list comes from
The 170 service entries and 246 URL fragments are literal endpoint substrings adapted from Aaron Lee's open-source MailTrackerBlocker (BSD-3-Clause, © 2020), a Mac Mail extension that blocks the same requests at the network layer, plus vendor-documented tracking endpoints. Matching is deliberately plain case-insensitive substring comparison, not regular expressions: an over-general fragment such as /open would name vendors that never touched the message, so fragments that generic were dropped rather than kept to inflate the count. If no fragment matches, the detector says "unlabelled" instead of guessing.
What this tool cannot see
Three blind spots, stated plainly. A beacon hosted on the sender's own domain with a normal-looking path is reported as a signal but cannot be named. Anything outside the pasted source — an image in an attachment, a tracker on the page a link leads to, a server-side log of the delivery itself — is out of scope. And open counts are no longer a clean measurement in either direction: Gmail rewrites image fetches through its own proxy, and Apple Mail Privacy Protection prefetches them through iCloud before you look, so a "read" event can be a machine rather than a person.
field notes
How can you tell if an email is tracking you?
You can tell by looking at the message's plumbing rather than its prose. The visible part is a paragraph and two buttons; the source behind it is a header block and an HTML part containing an image nobody asked for, a link that does not point where it says it points, and a query string with your address in it. Three things to look for, in the order they matter:
- A hidden image on someone else's domain. Usually 1×1, often
display:none, usually namedopen.gif,pixel.png,spacer.gifor a meaningless hash. This is the open counter. - Links that do not go to where they say. If the anchor reads yourbank.com and the status bar shows
email-tracker.net/wf/click?upn=…, the click is logged before you are redirected. - An identifier only you have.
mc_eid=,rid=,vid=,key=, or the whole address URL-encoded. It is what turns an anonymous request into your request.
Revealing the raw source is the step people skip, because every mail client hides it behind one menu. In Gmail it is ⋮ → Show original; in Apple Mail, View → Message → Raw Source (⌥⌘U); in Thunderbird, View → Source; in Outlook on Windows, File → Properties → the Internet headers box. Paste the lot into the detector above — headers included, because the header block is where the sending platform, the unsubscribe route and the authentication verdicts live.
What does an email tracker actually record?
One image request is a short HTTP GET, and a GET carries more about the caller than most people expect:
| What the sender learns | Where it comes from | How it is used |
|---|---|---|
| That you opened it, to the second | The timestamp of the image request | "Opened 3 times, last at 07:12" on a salesperson's screen |
| Your approximate location | Your IP address in the request | City-level geo; the trigger for "recipient is in a new region" |
| Your device and client | The User-Agent header | Mobile vs desktop, Gmail vs Outlook — feeds send-time optimisation |
| Which link you clicked, and when | The click-wrapper request | Interest scoring: pricing page vs careers page |
| What you did after the click | Campaign parameters on the destination URL | The web session is joined to the email profile |
| All of it, tied to your address | The per-recipient identifier in the URL | A durable row in a CRM, not an anonymous event |
| Whether the address is live | The request itself, or a bounced delivery | Confirmed addresses get sold, rented or re-targeted |
The last row is the one that matters beyond the sender. Once a tracker knows an address is read by a human, that fact is worth something on its own — it is how "verified active email lists" get built, and why a mailing you never joined starts arriving.
Who uses email tracking, and why?
Four groups, with four different motives, and the detector labels all of them:
- Sales and recruiting teams. Mailtrack, Yesware, HubSpot Sales, Streak, Mixmax, Outreach, Salesloft and the rest attach an open pixel plus click tracking to a one-to-one email, so the sender knows to follow up while your answer is still warm.
- Marketing platforms. Mailchimp, Klaviyo, SendGrid, Braze, ActiveCampaign and every ESP wrap links and add
utm_*parameters so the campaign reports can attribute a sale to a send. - Publishers and loyalty senders. Beeswax, DoubleVerify, Integral Ad Science and similar measurement vendors land inside newsletter HTML — a third party measuring the mail you thought was between you and the writer.
- People you did not consent to. A phishing email can use the same pixel as a live-address checker before the real attempt. Load the "Phishing" sample above to see what that looks like: failed SPF, DKIM and DMARC, a return path on an unrelated domain, and your address sitting in the link.
Is email tracking against the law?
In the EU and UK, an invisible beacon that identifies a recipient is not a grey area in principle. It stores and retrieves information on the recipient's device, which Article 5(3) of the ePrivacy Directive places behind the same consent requirement as a cookie, and the Court of Justice reinforced in Case C-80/18 (October 2021) that consent is required for storing or accessing information on terminal equipment. What the pixel then collects — an IP address and an identifier tied to a person — is personal data under GDPR, which needs a lawful basis, a disclosure in the privacy policy and a retention period. In North America the rules are narrower but real: CAN-SPAM requires a functioning unsubscribe route, and since February 2024 Gmail and Yahoo have required bulk senders to publish one-click unsubscribe per RFC 8058.
The gap between rule and practice is the honest headline: tracking is ubiquitous, and compliant disclosure of it is rare. The privacy policy analyzer checks whether a company's own policy even admits to it.
How do I stop being tracked by email?
Three settings cover most of it, in decreasing order of effectiveness. Block remote images by default — Gmail "Ask before displaying external images", Outlook "Block automatic downloads", Apple Mail "Protect Mail Activity", Thunderbird "Block remote content". No request, no open event. Strip the campaign tags by pasting links into a new tab and deleting everything after the first ?, or letting a link-expanding tool do it. Use a different address for anything you expect to be profiled — a newsletter or a signup whose identifier you do not want welded to your main mailbox. The step-by-step version, per client, is in the blocking guide.
What does not work: replying "remove me" (a reply confirms the address), clicking an unsubscribe link from an address you want to keep clean (it confirms the address and the identifier), and trusting an "I will not track you" promise. The pixel is not a policy question; it is an image request.
Related guides
- How email tracking works — the pixel, the wrapper and the identifier, explained on a real message.
- What email trackers learn about you — each signal and exactly what it discloses.
- How to block email tracking — settings for Gmail, Outlook, Apple Mail and Thunderbird.
- Privacy Policy Requirements: The 12-Point GDPR Checklist — what a policy must say about tracking.
- Privacy tools category — every browser-side utility on Daily Utility Lab.
faq
Frequently Asked Questions
How to read a message's source, what a pixel is, and where your email goes in this tool (nowhere).
How do I know if an email is tracking me?
Look for three things in the message's raw source: a tiny or hidden image whose URL points at a domain other than the sender's, links that route through a click-tracking domain before reaching the real site, and a per-recipient identifier such as mc_eid or rid in those URLs. Paste the raw source into the detector above and it flags all three, names the tracking service where the URL matches a known provider, and scores how much the message can learn about you.
Where do I find the raw source of an email?
In Gmail, open the message and choose ⋮ → Show original. In Apple Mail choose View → Message → Raw Source, or press ⌥⌘U. In Outlook on Windows, open File → Properties and copy the Internet headers box. In Thunderbird, View → Source. Copy the whole thing including the header block: the headers carry the campaign identifiers, the unsubscribe declarations and the SPF, DKIM and DMARC results.
Does this tool upload or store the email I paste?
No. The parsing is JavaScript running in this tab: there is no upload endpoint, no fetch call and no analytics script, so the message never leaves your device. Close the tab and it is gone. With DevTools open on the Network panel you can watch that nothing is requested while you type.
What is an email tracking pixel?
A tracking pixel is an image - usually one pixel square, often styled display:none - whose URL is unique to you. Opening the email makes your mail client request that image from the sender's server, and the request carries the time of the open, your IP address and your mail client's user-agent string. The sender never sees the picture; they see the request for it.
Can an email tracker be hidden from this detector?
Yes. A sender who hosts a beacon on their own domain with an ordinary-looking path is reported as an unlabelled signal rather than a named service, and anything outside the pasted text is invisible: a tracker in an attachment, a pixel in a linked web page, or server-side tracking of a link you never opened. A clean score means "no known signals in this source", not "this email is not tracked".
Does turning off image loading stop email tracking?
It stops the open counter, which is the loudest signal, but not the rest. Campaign parameters and click-tracking links still log every click you make, and the per-recipient identifier stays welded into the message. Two mailboxes blur the picture further: Gmail rewrites image requests through its own proxy, and Apple Mail Privacy Protection fetches them in advance through iCloud, so open counts from those clients are inflated and the IP and device data is masked.
Is email open tracking legal under GDPR?
Not in the way most senders practise it. A tracking pixel stores and retrieves information on your device, which the ePrivacy Directive puts behind the same consent rule as a cookie, and the Court of Justice confirmed in Case C-80/18 (October 2021) that consent is required for storing or accessing information on terminal equipment. The pixel also processes personal data - your IP address and the identifier tied to your mailbox - so a controller needs a lawful basis and a disclosure in its privacy policy. Most senders have neither, which makes the accurate summary "widely done, rarely compliant".