nudl v0.1.0

nudl strips the tracking junk off any link you copy — in Slack, Discord, a terminal, a doc, your browser — and hands back the same real link, trimmed.

ClearURLs only works inside a browser. nudl works everywhere else.

Install

Download nudl-0.1.0-win64.zip below, unzip it anywhere, run nudl.exe.

It's an unsigned build, so SmartScreen will show "Windows protected your PC." Click More info → Run anyway. I'd rather tell you that up front than have you discover it. See Is it safe? below.

What it does

• Strips tracking parameters: utm_*, fbclid, gclid, msclkid, igshid, Amazon's tag / ref_, and friends.
• Unwraps redirect wrappers: l.facebook.com/l.php, google.com/url, out.reddit.com, and others — you get the destination they were hiding, not the wrapper.
• Two modes: press Ctrl+Alt+V, or turn on automatic mode and every link is cleaned the instant you copy it, in any app.
• Undo on every change: click the toast, or press the hotkey again within three seconds.

It is not a URL shortener. No alias, no server, no redirect — the output is the real destination, just shorter. The link can't rot, because it was never replaced.

The promise: it never silently breaks a link you needed

This is the whole product. Anyone can delete query parameters; the hard part is knowing what to leave alone.

• Signed URLs are never touched. Anything carrying sig, hmac, token, expires, or an X-Amz-* key is left completely alone — signed URLs sign the whole query, so removing any parameter turns the link into a 403.
• Only known trackers are stripped. nudl works from a small allowlist and never guesses, which is why YouTube's ?v= and ?t=, Spotify's ?si=, ?page= and ?q= all survive by default.
• Values are never rewritten. Only the key of each parameter is inspected, so a parameter whose value merely looks like a tracker (?redirect=utm_source_page) can't be mangled, and %20 never quietly becomes +.
• A no-op is silent. If nudl didn't change your link, you'll never know it ran.

The test suite is 110 tests, including a corpus of 50 hand-vetted before/after URLs — a quarter of them "looks like tracking but isn't" tripwires, the cases where a careless cleaner breaks a working link.

nudl never sends your URLs anywhere

Zero network calls. No account, no telemetry, nothing leaves your machine. That's not a policy, it's a property of the code — the test suite replays every URL in the corpus with the socket layer patched to throw on any connection attempt.

There's a local audit log at %AppData%\nudl\clean.log recording every change nudl has ever made, so you can check its work rather than trust it.

Is it safe?

It's a small unsigned tool that reads your clipboard. Being suspicious is the correct reaction.

• It uses RegisterHotKey, which asks Windows to deliver one specific chord and nothing else. It does not install a low-level keyboard hook — that's the keylogger technique. nudl never sees any keystroke but its own shortcut.
• The whole cleaning engine is one file you can read in ten minutes: src/clean.py. The rule set is one readable JSON file: src/rules.json.

The VirusTotal score, stated plainly

1 of ~70 engines flags the download — that link scans nudl-0.1.0-win64.zip itself, the exact file attached below. I'd rather you hear it from me than find it yourself.

That detection is an ML heuristic reacting to PyInstaller, not to nudl: bundling a Python interpreter into a self-extracting executable looks structurally like a packer, and aggressive engines flag tools built that way regardless of what they do. It's a known false-positive pattern, not a finding about this code.

Microsoft Defender scans it clean — current signatures, real-time protection on — and Defender is what actually decides whether nudl runs on your machine. Every major engine reads clean.

For completeness: the bootloader nudl.exe scanned alone draws 3 flags. That file is a stub containing none of nudl's logic — it can't even start without the _internal folder beside it. The zip is the honest scan, and it's what you download.

Not good enough for you? Fair. Run it from source — no packed binary, every line readable.

Verify the download

Get-FileHash nudl-0.1.0-win64.zip -Algorithm SHA256
# 96d640071927403ae992e2647d106238621f23e526b5b554df1006028b3c4261

SmartScreen's warning means it doesn't recognise the publisher — not that it found anything. Code signing is on the roadmap.

Known limits

• Windows only (11; 10 best-effort).
• No network un-shortening of bit.ly / t.co — that would leak your link and can burn one-time URLs. They're returned unchanged.
• Redirect wrappers that carry their own ?token= (some out.reddit.com links) are left alone rather than half-rewritten. Safe, but they won't unwrap.

Requirements

Windows 11. No Python needed — everything is bundled.