A friend of mine, a freelancer, recently went on a much-deserved vacation. Like most of us in today's always-on culture, she left an automated "I'm away" response on her email.
One day, she received a message from a client. Curious whether it might be urgent, she opened the email — but chose not to reply. A few hours later, she received another email from the same client:
"I know you opened our email. Can you please answer to our job offer?"
Creepy material right there.
How in two hecks did the client know that she had opened their email and read their message, without her replying? The answer is tiny, technically invisible, and fascinating — a spy pixel!
There's totally a Spy Pixel there, trust me bro.
But what are they?
A spy pixel is a tiny, invisible image that gets embedded in emails. Usually just a 1x1 pixel, fully transparent, and basically impossible to spot by just looking at the email.
The moment your email app loads it — boom — it sends a signal back to whoever embedded it.
What's in that signal? Well, I'm glad you asked. It can include, at the very least:
- Your IP address (which can give away your rough location),
- The exact time when you opened the email,
- Your device type, OS, maybe even your browser,
- Whether you opened it multiple times or forwarded it to someone else.
Here's her little spy:
<img src=3D"https://app.frontapp.com/api/1/noau=
th/companies/5faa110782efdfc2d885/seen/msg_uugvds6/0/0a5b6123.gif" alt=3D"S=
ent from Front" aria-hidden=3D"true" style=3D"width: 1px; height: 1px">
That image isn't there to show anything. It's there to quietly send metadata back to the pixel's creator.
Where and when are these buggers used?
You might be surprised — they're everywhere in digital communications. Here are some common uses:
- Email newsletters and marketing campaigns, to track open rates,
- Sales outreach tools, for engagement tracking,
- Transactional emails, just to confirm delivery.
But also in more questionable cases:
- Stalking or surveillance by controlling or manipulative individuals,
- Aggressive sales tactics, that cross boundaries (case in point: my friend),
- Phishing campaigns, to confirm which addresses are active.
And, for the most part — barring some exceptions — this stuff is completely legal.
Fear-mongering
I love some areas of cybersecurity, but I'm definitely not a fan of the constant fear-mongering I see everywhere.
This stuff is genuinely cool! And interesting. And did I say cool? But it has its downsides. Serious ones, especially when you are on the receiving end of it. Most people don't know these pixels exist, let alone how to block them.
I B Nautghy!
Action.
Are we allowed to lie to protect our privacy or avoid annoying people? I think we are. But that becomes hard when someone throws back:
- "We know you were at your computer yesterday."
- "You say you didn't see our message, but we know you did."
- Or you try to browse anonymously, and the pixel exposes your location
This little guy can enable social engineering attacks by confirming your device type, when you were online, even whether you forwarded the email.
And, all that advice about "not clicking suspicious links"?
You didn't! You just opened the email. And that's all it takes
You gotta fight, for your right. (to party)
Thankfully, we've got defenses. Here are some of the basics:
Block remote images in your email client (Thunderbird, ProtonMail, and others do this by default),
-
Use privacy-focused email services that prevent images from auto-loading,
-
Browser plugins like uBlock Origin can help if you're using webmail,
-
Use a VPN to mask your IP and location,
-
Or go hardcore and view emails in plain text only.
Just a heads-up: many mobile apps load images by default unless you manually turn that off. And in some cases, you can’t.
Oops...
DIY Spy Pixel.
Want to try one for fun? Here’s a simple experiment:
-
Host a transparent 1x1 GIF or PNG on your own server.
-
Log image requests using your server (e.g., Apache, nginx, or a basic Flask script).
-
Add this to an HTML email:
<img src="https://yourdomain.com/tracker.gif" width="1" height="1" />
Send it to yourself.
-
Open it and check your logs — you'll probably see something like:
-
IP address
-
User-Agent string (your OS, browser, etc.)
-
Timestamp
-
Research how to do this stuff if it’s new to you. It’s a great little exercise and can be done in an afternoon.
Beyond the Pixel
Our tiny spy pal isn’t alone.
There’s a whole army of sneaky tools out there:
-
Link shorteners with tracking redirects,
-
Invisible iframes embedded in webmail,
-
Email fingerprinting, using subtle code to track opens,
-
Read receipts in platforms like Slack, Notion, and LinkedIn.
Once you notice this stuff, it’s everywhere.
A final dot.
Have fun exploring. Even if this isn't your favorite cybersec topic, it's a fun rabbit hole and might lead you to some unexpected discoveries.
And as always — enjoy the ride.
