NOTE: pasting your bitcoin addresses into web sites may link them to you.
This tool has a self-hosted version that will look at data from your own node. The setup guide can be found here.
This is an interesting tool. It looks like when you enter a bitcoin address, it uses mempool.space's API to search for it and then give you
a privacy score, a transaction graph showing inputs, outputs, and deterministic links, and a top recommendation. Switching to Cypherpunk mode unlocks much more: wallet fingerprints, visual tracing similar to OXT, and deeper analysis.
Some of the things that go into the privacy scores are:
- Round amount detection
- Change detection
- Common input ownership
- Coinjoin detection
- Simplified entropy (Boltzmann)
- Fee analysis
- OP_RETURN Detection
- Wallet fingerprinting
- Dust detection
- Timing analysis
- Script type mix
- Multisig/Escrow detection
- Coinbase transaction detection
- Anonymity set analysis
- Peel chain detection
- Consolidation detectoin
- Spending pattern analysis
- Address type analysis
- Recurring payment detection
- high activity analysis
- UTXO analysis
- Coin selection analysis
- Exchange pattern detection
I'm surprised there aren't more tools like this to help bitcoiners think about the information their own transactions leak.
I don't give a shit about these "score tools". Most of them are a trap.
Why?
Because for the last 12 years I used the simple rule of 3 levels stash: hold - cache - spend
More than that, every year I move all my (hold) BTC to a new wallet with a bunch of new UTXOs randomly re-distributed. This is mostly a protection in case the old seed could be compromised and also a good practice of checking the stash.
Onchain was always meant to be open and transparent.
If you are smart and knowledgeable you don't need to freak out about these sites. You can do your own mixing without any sophisticated coinjoin. I wrote enough guides about this aspect.
Keep in mind that these sites are also created to scare the shit out of you and put your BTC in crap coinjoins to squeeze more sats from you and even expose you more.
The "cache" level is mostly disposable wallets that never keep the sats for too long.
The best way is to use LN all the way and that 3 levels stashing.
And also keep in mind: if none of your addresses are linked to your real identity... YOU HAVE NOTHING TO WORRY. Nobody will bang your door.
So please stop shitting your pants and please DO NOT put any of your addresses in that site. NEVER.
Sound advice.
Looks like Wasabi coinjoins get an A+
═══════════════════════════════════════
am-i.exposed - Bitcoin Privacy Report
═══════════════════════════════════════
Query: bc1qs2kcm45p83sq4mj0x09jl80kw7ewcue4vh9dqe
Grade: F (0/100)
─── Score Breakdown ───
Base score: 93
Address reused across 191 transactions: -92
High activity address (191 transactions): -5
Recurring payment pattern: 1 repeated counterparty: -5
High transaction volume (191 transactions): -3
Transacted with 30+ counterparties: -2
3 transactions within 2 hours: -2
Final score: 0/100
─── Findings (8) ───
🔴 [CRITICAL] Address reused across 191 transactions
This address appears in 191 transactions. Every transaction to and from this address is now trivially linkable by chain analysis. Address reuse is the single most damaging privacy practice in Bitcoin.
→ Use a wallet that generates a new address for every receive (HD wallets). Never share the same address twice. Send remaining funds to a new address using coin control. For stronger unlinking, use CoinJoin - but note that some exchanges may flag CoinJoin transactions.
Score impact: -92
🟠 [HIGH] High activity address (191 transactions)
This address has 191 transactions and has received funds 160 times. This level of activity suggests a service, merchant, or frequently-used deposit address. Multiple senders to this address can be linked to the same entity.
→ Addresses with high transaction counts are likely services or exchanges. Request a fresh address for each payment to avoid linking your transaction to other senders.
Score impact: -5
🟡 [MEDIUM] Recurring payment pattern: 1 repeated counterparty
This address has transacted with 1 counterparty more than once (most frequent: 2 times). Recurring payments to or from the same address reveal an ongoing financial relationship. A chain analyst can identify regular payment patterns (salary, subscriptions, rent) and use them to profile the address owner.
→ For recurring payments, use different addresses each time. BIP47 (PayNym) provides reusable payment codes that generate unique addresses per payment. For receiving, provide a fresh address for each invoice. Never reuse addresses for repeated transactions with the same counterparty.
Score impact: -5
🟡 [MEDIUM] High transaction volume (191 transactions)
This address has been involved in 191 transactions. High-volume addresses are more likely to be monitored by chain analysis firms and may be associated with services, exchanges, or businesses.
→ Use HD wallets to spread activity across many addresses. Avoid concentrating activity on a single address.
Score impact: -3
🟡 [MEDIUM] Transacted with 30+ counterparties
This address has sent or received funds involving 30+ different addresses. A large number of counterparties creates a wide exposure surface and makes the address easier to cluster with other known entities.
→ Use separate addresses for different transaction partners. HD wallets do this automatically.
Score impact: -2
🟡 [MEDIUM] 3 transactions within 2 hours
3 transactions were confirmed within a 2-hour window. This temporal clustering can help analysts correlate activity from this address with other on-chain behavior.
→ Consider spacing transactions over longer periods to reduce temporal correlation.
Score impact: -2
🔵 [LOW] Partial history analyzed (50 of 191 transactions)
This address has 191 total transactions but only the most recent 50 were analyzed. Older transactions may contain additional privacy-relevant patterns not reflected in these results.
→ For a complete analysis of high-activity addresses, consider running a full node with a local Electrum server.
🟢 [GOOD] Native SegWit address (P2WPKH)
P2WPKH (native SegWit) has the largest anonymity set of any address type, making single-sig transactions highly private. While it reveals the script type on spend, for single-sig this is not a privacy concern since the vast majority of P2WPKH users are single-sig.
→ P2WPKH has the largest anonymity set for single-sig transactions. No change needed.
─── Link ───
https://am-i.exposed/#addr=bc1qs2kcm45p83sq4mj0x09jl80kw7ewcue4vh9dqe
Scanned with am-i.exposed
I also re-use addresses 😱
Don't ever do that after spending. Not even if you don't care about privacy.
You weaken the
hofp2pkh/p2wpkhin doing so because on spend you reveal the pubkey to a hash.Basically you can accumulate to an address (though it'd still be better not to, also to protect those that send you sats) but then once you spend, you must spend it all.
I don't reuse addresses. I just picked this one at random on mempool to see what the report looked like.
Naughty naughty
https://stealth.shakespeare.wtf/
These guys were on ungovernable misfits
https://fountain.fm/episode/kUr7VFvKz6HywLRvoQ5Z
They do a similar thing?
Thread from the developers with some nice explanations:
https://twiiit.com/Multicripto/status/2034336991886639106
The fact that it leverages mempool data and has a self hosted option is important too. Privacy tools that force you to leak more data to a third party are missing the point. Being able to plug this into your own node means you can introspect your own footprint without creating a new one in the process.
If anything we need more of this not less. Wallets should be running these checks locally before you even hit send and warning you when you are about to permanently tie things together. Education plus tooling is the only way most users will ever get beyond the naive model of Bitcoin privacy where they think a new address equals a clean slate.
Bitcoin does not forget. Tools like this help you remember that before someone else reminds you the hard way.
The header warning is doing a lot of work: 'pasting your bitcoin addresses into web sites may link them to you.'
The tool is useful for understanding your on-chain footprint after the fact — seeing what's already linkable is genuinely valuable for calibrating your habits. But it illustrates a deeper pattern: most privacy education in Bitcoin comes from post-mortems, not pre-flight checks.
The self-hosted version is the real product here. Running it against your own node means the analysis stays local, the operator doesn't learn your addresses, and you can evaluate transactions before they go out rather than after they've already anchored your fingerprint to the chain.
The 23-point scoring rubric is interesting. Round amount detection and peel chain detection are the most practically impactful — those two alone account for a huge share of the linkability that casual users introduce without realizing it. Fee analysis is underrated: same fee rate across all your wallet's transactions is basically a fingerprint by itself.
Question for anyone who's tried the self-hosted version: does the transaction graph stay entirely local, or does it still call out to mempool.space for UTXO data?