LLL Campaign URL Builder

FAQ

Does this verify Analytics or count clicks? No. It only generates UTM tags. Visits/reporting depend on destination measurement, consent, redirects and user activity. No Google account or tracking connection.

Are URLs saved, sent or opened? No plugin storage/logs/network/shortening/opening or clipboard access. Input/output stays in the current admin response/browser. Host/proxy/browser retention is separate. Protect copied URLs; never include secrets or personal data.

Existing UTM tags? Any decoded utm_* key is rejected case-insensitively, including duplicates and utm_id. Remove old tags explicitly. Other query keys (including repeats) and fragments are preserved.

Unicode/IDN? Version0.1.1 validates with bundled standard WHATWG parseURL, avoiding the legacy URL implementation in the tested Node dev runner. Original host/path/query/fragment text is retained in output. Standard IDNA data is losslessly compressed for packaging; no extra permission/network. Case and inner spaces in tags stay unchanged and are encoded. Leading/trailing whitespace and controls are rejected.

Limits and scope? Single HTTPS URL4096UTF8B, each tag100Unicode codepoints/400B, encoded result8192B; private request16KiB. No destination safety/reachability check. Free MIT version; no paid edition, history, presets, bulk, QR or automatic download.

日本語は？ Languageで日本語を選び、結果全文を手動コピーします。生成とGA接続・受信確認は別です。

Support: contact@lx3.cafe; version and redacted synthetic steps only, never secrets/private URLs.

Security and privacy

LLL Inc. Version0.1.1,2026-11-05. MIT. This describes the implemented boundary, not a compliance certification.

No capabilities, allowedHosts or hooks. One private POST JSON admin route,16KiB, host plugins:manage authorization. No public route, content/schema access, CMS/KV writes, HTTP, cron, Google/API credentials, telemetry or payment integration. Host-attested user identity is required; input cannot select authority.

URL/tag processing is ephemeral in the current admin request and returned plain code. This plugin never logs or stores input/output. Host, proxy and browser request retention is governed separately. Do not enter personal information, credentials, secret tokens or private URLs. Copying/sharing intentionally reveals query values to recipients; do not publish confidential campaigns accidentally.

Only absolute HTTPS strings accepted; userinfo (including empty raw@), controls, backslashes, malformed percent escapes and ambiguous empty authority rejected. All pre-existing case-insensitive decoded utm_* query keys are refused. No replacement, destination fetch or opening. Output is code/text, not an active link. Limits: base4096UTF8B, fields100codepoints/400B each, output8192B. No real-world destination safety or Analytics-receipt guarantee.

Report vulnerabilities to contact@lx3.cafe with version and a redacted synthetic reproduction. No SLA/bounty offered. Do not send live tokens, personal data, account access or private URLs.

URL validation uses pinned whatwg-url14.2.0 parseURL with unchanged standard IDNA algorithms. Standard tr465.1.1 table and RegExp source/flags are losslessly compressed in the build and restored from fixed bundled bytes; no user data is decompressed. tiny-inflate1.0.3 only restores those constants. No global URL mutation, custom host parser, shared runner setting change, new capability or connection. Full dependency licenses are included in README.

Changelog

0.1.1 — 2026-11-05

Fixes IDN/host validation in the official Node development sandbox by using a self-contained standard WHATWG parseURL implementation. Standard IDNA data is losslessly compressed for official size limits. Preserves original URL text in output and prior UTM/authority/field/byte rejection rules. No capability, network, storage or UI workflow change;0.1.0 release/artifact remains unchanged.

0.1.0 — 2026-11-05

Initial single-URL campaign tag generator. English/Japanese private administration, source/medium/campaign plus optional content/term, exact non-UTM query/fragment retention and manual code copy. Existing UTM parameters rejected. No saved state, requested capabilities, external requests, tracking, shortening, account connection or automatic opening.

Installation and use

Version0.1.1. Tested with EmDash1.4.0. Administrator/plugin-management access is required.

Find LLL Campaign URL Builder in the standard EmDash Registry after public availability. Publisher: LLL Inc. (mrhandsome39.bsky.social). Check the signed release; this product requests no capabilities and no allowed network hosts. Open Campaign URL Builder in administration.

Paste an absolute HTTPS destination URL. Enter source, medium and campaign; content/term are optional. Choose English or Japanese and Generate. Select the entire plain code result and copy manually. The result is not automatically opened or posted. This version rejects all existing utm_* query keys, including uppercase or repeated ones. Explicitly remove them yourself before rebuilding. Other query parameters and the fragment are retained; tag case and inner spaces are preserved.

Keep personal information, passwords and secret tokens out of both URL and tags. Do not include private URLs. Generating a URL does not connect Analytics, prove a visit or verify receipt. Configure measurement and consent independently at the destination and test reception there. No analytics identifier or Google account is requested here.

入力は絶対HTTPS URL、source/medium/campaign必須、content/term任意です。既存utm_*は自動上書きしません。日本語に切り替えて生成し、コード全文を手動コピーしてください。GA受信やリンク先の到達は確認しません。