The Silent Leak: Identifying Users via Shared Links

Most users are unaware that when they click "Share" on TikTok, they are attaching a digital fingerprint to the link.

If you receive a shortened link (like vt.tiktok.com/ZS...) in a Telegram chat, Discord server, or SMS, that link contains more than just the video destination. It contains the identity of the person who generated it.

I have released a new URL Tracker tool designed specifically for OSINT (Open Source Intelligence) purposes. It allows you to reverse-lookup the sender of any short link.

Open URL Tracker

What Does It Reveal?

When you paste a shortened link into the tool, it decodes the redirect chain and extracts hidden parameters from the metadata.

It reveals three key pieces of information:

• The Sharer's User ID (UID): The unique account ID of the person who clicked the share button.
• Timestamp: The exact date and time (down to the second) when the link was generated.
• Video ID: The ID of the content being shared.

Bypassing Privacy Settings

TikTok offers a privacy setting called "Suggest your account to others." Many users believe that turning this off protects their identity when sharing links.

This is false.

Even with that setting disabled, the generated link must contain a reference to the creator for analytics purposes. Our tool reads this reference directly. It works on videos, stories, and even profile shares.

How to Use It

The process is essentially a two-step de-anonymization:

1. Get the ID: Paste the short link into the URL Tracker to get the User ID.

2. Find the User: Copy that ID and use the Main Tool (User Finder) to resolve it into a username, profile picture, and account stats.

How to Share Safely (Avoid Leaking)

If you want to share a link without exposing your identity, you must manually "sanitize" the URL before sending it.

The leak occurs in the query parameters (everything after the ? symbol).

Step 1: Expand the short link (open it in a browser) so you see the full URL.

Step 2: Remove the tracking parameters.

By stripping everything after the Video ID, you ensure that the link serves the content without carrying your personal digital signature.