What a site name reveals, and what a full URL would give away

25 September 2026 · 6 min read

A full web address can carry what you searched for, which document or order you opened, your email address, and sometimes a working sign-in link. The site name alone (the host, such as github.com) carries far less: it says where you were, not what you did there. That difference is real, and it has limits, because a site name can still say you spent time at a bank, a clinic or a job board. Here is how to read an address, what each part tends to reveal, and how to check what any tool keeps.

The parts of a web address

Take a made-up address (the .example ending is reserved for names that will never exist on the internet):

https://www.Riverside-Clinic.example/patients/dermatology/reschedule?appt=48213&email=sam%40mail.example#confirm

Read left to right, it has five parts:

Scheme: https. How the browser talks to the site. Nothing personal.
Host: www.Riverside-Clinic.example. The site’s name, including any subdomain in front of it, such as www. or portal.. Capital letters make no difference here.
Path: /patients/dermatology/reschedule. Which page on the site.
Query: everything after the ?, here appt=48213&email=sam%40mail.example. Name and value pairs joined by & that the page uses. %40 is an encoded @, so that is an email address.
Fragment: everything after the #, here confirm. A position or state inside the page. It is handled in the browser rather than sent to the site with the request, which is why some sign-in systems put short-lived tokens there.

The address runs from general to specific. The host says where; the path says which part of the site; the query and fragment say exactly what. A record that keeps only the host would note riverside-clinic.example and nothing else. As you will see below, that is still not nothing.

What the path and query commonly carry

Not every address is sensitive, but these turn up constantly:

Search terms. Most search results pages put your query in the address, on search engines, shops, health sites and job boards alike. A symptom, a lawyer’s specialty, a salary range: whatever you typed is in the query.
Document and record identifiers. Links to documents, tickets, invoices, orders and patient portals usually include an identifier in the path or query. For a document shared as “anyone with the link”, that identifier is effectively the key.
Email addresses and customer numbers. Links in receipts, newsletters and account emails often carry your email address or an account number in the query, as in the example above.
Sign-in and reset tokens. Password reset links, one-click sign-in links and email confirmation links carry a one-time code. Until it expires or is used, anyone holding the full address may be able to use it.
Topics in the path. Many sites write the subject into the path so it reads well: /patients/dermatology/, /forums/debt-help/, /jobs/apply/senior-designer. With no query at all, a path can name a diagnosis, a money worry or the job you are applying for.

Page titles are not part of the address, but tools that record browsing often keep them alongside it, and titles repeat much of the same: the document’s name, the email subject, the search you ran.

So a log of full addresses is close to a diary. It is also what your browser’s own history already holds, until you clear it. The question to ask of any other tool is whether it makes a second copy, and how detailed that copy is.

What the site name still says

Keeping only the host removes everything in the section above. It does not make a record anonymous. A host on its own still says:

What kind of place you were in. riverside-clinic.example says clinic. A bank’s host says banking, a job board’s says job search. Single-purpose sites name their purpose.
Sometimes who. Some services give each customer organization its own subdomain, in the form acme.helpdesk.example, so a host can name an employer or a client.
When, and how long. Hosts with times form a pattern. Twenty minutes on a clinic’s portal every Tuesday says something without a single path.

Where a host reveals least is on large, general platforms. docs.google.com says you were in a document, not which one; youtube.com says you watched something, not what. So “site name only” protects the most on general platforms and the least on specialist sites. That is the honest shape of it.

How to check what a tool keeps

A privacy page is a claim. The data is the evidence, and on a Mac you can usually read it.

Export and read the site column. If the tool exports CSV, open the file in Numbers or TextEdit and find the column that holds sites. Scan it for any /, ? or =: a tool that keeps hosts only will never have one there.
Plant something to look for. In a browser the tool records, search for a word you would never normally type, and stay on the results page for a few minutes so it counts.
Search the tool’s data file for that word. Most apps keep data under ~/Library/Application Support; where Mac apps keep your data covers the usual places. If the file is SQLite, quit the app, copy the file, and search the copy. For Punchcard:

cp ~/Library/Application\ Support/Punchcard/punchcard.sqlite ~/Desktop/check.sqlite sqlite3 ~/Desktop/check.sqlite .dump | grep -i "yourplantedword"

No output means the word is not stored anywhere in the file. Delete the copy afterwards. Reading your own time data with sqlite3 goes further.

If step 3 finds your search term, the tool keeps more than hosts, whatever its settings page says.

Punchcard’s rule

Punchcard is a menu bar app that prints a paper receipt of your day, itemized by app. Out of the box it records app names only and never sees an address. If you switch on “Itemize websites” in Settings, browser time in Chrome, Brave, Edge and Vivaldi prints as the sites you used.

When it asks the browser for the front tab’s address, it keeps the host only, lower-cased, with a leading www. removed. https://www.GitHub.com/a/b?c#d becomes github.com. The path, query, fragment and page title are never kept. New tabs, settings pages, files and extension pages are not websites and are never kept either; they stay on the browser’s own line, as do sites you spent under a minute on, so the day total never changes. Private windows are never asked for their address at all. The record stays in one file on your Mac, and the CSV export has a site column, so the checks above work on it.

The limits in the previous sections apply to Punchcard too. A clinic’s host is still a clinic’s host, and the subdomain stays in the name. For sites that are nobody’s business, use a private window (its time stays on the browser line), or Settings, “Hide a website…”, where you can type bank.com, a full address or *.bank.com. Hidden sites are left off receipts, streaks and the past-days list, but the record stays in the local file until you delete it; Burn the roll deletes everything. How to hide a website from your time record walks through it.

What it does not do: itemize Safari, Firefox or Arc, or keep a full address or page title under any setting.

Questions

Is a site name enough for someone to know what I read?

Not which page. On a single-purpose site, though, the name alone is often enough to know the subject.

Does HTTPS hide the full address from my network?

HTTPS encrypts the path, query and page contents between you and the site, so your network sees far less than the full address. The host name is usually still visible to it: the same part a site-name-only record keeps.

Does hiding a website in Punchcard delete it?

No. It leaves the site off receipts, streaks and the past-days list, but the record stays in the local file until you delete it. Burn the roll deletes everything.