Find every tracking pixel on a page: scan tags from a HAR file or bookmarklet

Ask anyone who has inherited a website which tags are actually firing on it, and the honest answer is usually “whatever the tag manager says, plus some things nobody remembers adding.” Pixels accumulate: an agency adds a Meta Pixel for one campaign, a developer hardcodes Hotjar, a plugin quietly loads Criteo. The tag manager container tells you what should fire; only the network requests tell you what does. Reading those requests by hand in DevTools means recognizing dozens of vendor hostnames and knowing where each one hides its account ID.

The Pixel & Tag Scanner does that recognition for you. Feed it a page’s network requests — via a drag-to-bookmarks bookmarklet or a .har export from DevTools — and it returns a categorized inventory: which analytics, advertising, social, session-replay, CDP, experimentation, consent, and error-monitoring vendors fired, how many requests each one made, and the account, property, or pixel ID each request carried. It’s 100% client-side: every request you paste is matched locally, nothing is uploaded, and the page works offline. The tool is labeled beta, and it’s the free counterpart to the hosted scan at ad.rip.

What it does

• Fingerprints 52 vendor signatures across nine categories: tag managers (GTM, gtag.js, Tealium iQ, Adobe Launch), analytics (GA4, legacy Universal Analytics, Amplitude, Mixpanel, Heap, PostHog, Plausible, Matomo, Snowplow, Cloudflare Web Analytics), ad pixels (Google Ads plus a dedicated gtag AW- conversion signature, Floodlight, DoubleClick, Microsoft UET, Criteo, Taboola, Outbrain, Amazon Ads), social pixels (Meta, TikTok, LinkedIn, X/Twitter, Pinterest, Reddit, Snap, Quora), session replay (Hotjar, Clarity, FullStory, LogRocket, Mouseflow, Smartlook), CDPs (Segment, RudderStack, Tealium Collect), experimentation (Optimizely, VWO, LaunchDarkly, Google Optimize), consent platforms (OneTrust, Cookiebot, Usercentrics, TrustArc), and error monitoring (Sentry, Bugsnag, Datadog RUM, New Relic).
• Extracts account IDs where the URL carries one: GTM- container IDs, G-/AW-/DC-/GT- measurement IDs, Meta pixel IDs, Bing UET tags, LinkedIn partner IDs, Clarity project codes, Hotjar site IDs, Segment write keys, Sentry project numbers, Cookiebot cbids, and more.
• Accepts four input formats: a full HAR export, the scanner’s own bookmarklet payload, a raw performance.getEntriesByType('resource') JSON dump, or a plain list of URLs (one per line). You can also drag a .har file straight onto the textarea.
• Reports transfer weight. When the input includes sizes (HAR or resource-timing data), the summary line shows total kilobytes transferred alongside the vendor and request counts.
• Exports the result as JSON — the full detection list with categories, IDs, request counts, byte counts, and a sample URL per vendor.

How it works

The detection engine (scanner.js) is pure logic with no dependencies and no DOM access; the same file runs in the browser and in Node.

Parsing. parseInput figures out what you pasted. If the text starts with { or [ it tries JSON.parse and then walks whichever shape it finds: a HAR (log.entries[].request.url), a bare { entries: [...] }, a performance-resource array of { name, transferSize } objects (or plain strings), the bookmarklet’s own { resources, scripts } payload, or a single object with a url or name field. Anything that isn’t JSON is split on newlines and whitespace into candidate URLs. A token only counts as a request URL if it’s absolute (https://…), protocol-relative (//…), or a bare hostname-plus-path — everything else is dropped.

Sizes. For HAR entries, the parser prefers response._transferSize, then falls back to bodySize, then content.size; for resource-timing entries it uses transferSize or encodedBodySize. Bytes are summed per URL and in total, then formatted as KB/MB for the summary.

Matching. Each of the 52 signatures is a test regex run against the full request URL — for example, GA4 matches the /g/collect endpoint on google-analytics.com or a Measurement Protocol v2 hit with a tid=G- parameter, while the legacy UA signature looks for /collect?v=1 or a tid=UA- ID. Every signature is checked against every URL, so one request can legitimately count toward two vendors (a gtag/js?id=AW- load is both the gtag loader and a Google Ads conversion tag).

ID extraction. Signatures that can name an account carry a second regex, extractId, with one or more capture groups; the first non-empty group wins, and duplicates are deduped per vendor. So gtm.js?id=GTM-ABC1234 yields GTM-ABC1234, analytics.js/v1/<key>/analytics.min.js yields the Segment write key, and ingest.sentry.io/api/<n>/ yields the Sentry project number.

Aggregation. Detections are deduped by vendor key, each accumulating a request count, byte total, unique ID list, and the first matching URL as a sample. Results sort by a fixed category order (tag managers first, then analytics, advertising, social, session replay, CDP, experimentation, consent, error monitoring), then by request count, then name — and render as a table grouped under category header rows.

The bookmarklet is the capture side. It runs on the page you’re inspecting, reads performance.getEntriesByType('resource') (URL and transferSize for each entry) plus every <script src> in the document, wraps them in a JSON payload with the page URL, and copies that payload to your clipboard. If clipboard access fails, it logs the payload to the console instead. It does not read cookies, page content, or form data — only timing entries and script URLs.

How to use it

1. Open the Pixel & Tag Scanner and, on the Bookmarklet tab, drag the “Scan Tags” button to your bookmarks bar. (The raw bookmarklet source is printed below it if you’d rather copy that.)
2. Visit the page you want to audit, let it fully load, and click the bookmark. An alert confirms how many requests and scripts were copied to your clipboard.
3. Back in the scanner, switch to the Paste HAR / requests tab, paste, and click Scan requests (or press Ctrl/Cmd+Enter).
4. Alternatively, skip the bookmarklet: export a HAR from DevTools (Network tab → export) and drop the .har file onto the textarea, or paste request URLs one per line.
5. Read the summary line (“N vendors detected across M requests”), scan the category-grouped table — vendor, category, detected IDs, request count, sample URL — and use Export JSON to save the result. Clear resets everything; nothing survives a page reload.

No page handy? The Sample button loads a realistic request list — GTM, GA4, Meta Pixel, Microsoft UET, Clarity, Hotjar, Segment, LinkedIn, OneTrust, plus non-tracking noise like Google Fonts — so you can see the output shape immediately.

Limitations

• You supply the requests. A static page can’t fetch another site’s traffic, so the scanner only sees what the bookmarklet or HAR captured. If your ad blocker killed a request before it fired, or a tag fires only after consent or scroll, it won’t be in the capture.
• URL pattern matching is heuristic. Detection keys off known hostnames and paths. Tags proxied through a first-party domain (server-side GTM, CNAME’d collectors) won’t match their vendor signature, and vendors outside the 52-signature list simply won’t be named.
• IDs come from URLs only. If a vendor sends its account ID in a POST body rather than the query string, the scanner shows the vendor with no ID.
• Snapshot, not monitoring. The scan reflects one page load at one moment. It can’t watch for tags that fire on later interactions or track changes over time — that’s what the hosted Tag Reaper crawl exists for.
• Beta. Signatures are curated and evolving; expect occasional misses on new vendor endpoints.

FAQ

Is anything I paste uploaded anywhere? No. All matching runs in your browser tab against a local signature list; the page makes no network calls, works offline, and forgets everything on reload. The bookmarklet likewise sends nothing — it only copies JSON to your own clipboard.

Why a bookmarklet instead of just entering a URL? A zero-backend page can’t load another site and observe its requests — that requires a server crawling the target. The bookmarklet runs in your browser on a page you already have open, so no third party ever sees the site’s traffic. If you want the enter-a-URL version, that’s the hosted scan at ad.rip.

Why does one request show up under two vendors? Every signature is tested against every URL by design. A gtag/js?id=AW-… request is both the Google gtag.js loader and a Google Ads conversion tag, so it counts for both rows.

What does “No known tags found” mean? Your input parsed into request URLs, but none matched the 52 signatures. That happens on genuinely tag-free pages, but also when tags are proxied first-party or served from endpoints the signature list doesn’t cover yet.

Can it tell me whether these tags fired before consent? Not directly — it inventories requests, it doesn’t sequence them against a CMP. Run the Consent Checker for consent-state analysis, or a scheduled Tag Reaper scan, which watches for tags firing on consent interactions.

Related

• Pixel & Tag Scanner — the tool itself, and the full tools index.
• Tag Reaper: the hosted, scheduled, server-side scan is the paid version of this tool — it loads the URL for you, captures every request, watches consent- and scroll-triggered tags, and tracks changes over time.
• Adjacent tools: decode what an individual hit contains with the Beacon Decoder, audit the container behind the tags with the GTM Container Explorer, inventory cookies with the Cookie Scanner, and check consent behavior with the Consent Checker.
• Background reading: how web tracking works, Google Tag Manager, and server-side tracking for why proxied tags evade URL signatures.
• Look up any vendor you find in the tracker directory, and see how the Privacy Scorecard methodology weighs them.