DecryptAds: Free Tool Exposes Hidden Ad Trackers and Data Brokers

Every website visit and mobile app interaction leaves behind a trail of adtech relationships that most users never see. A newly launched service called DecryptAds at decryptads.com is changing that by scraping and cross-referencing publicly available ad transparency files—ads.txt, app-ads.txt, buyers.json, and sellers.json—to expose the advertising partners and data brokers operating behind the scenes. The service was built by Zach Edwards, chief research officer at DecryptAds and a threat researcher at security firm Infoblox, along with two co-founders, who designed it to approach adtech from a security perspective rather than a marketing one. While these disclosure files have existed for years, their individual data is largely inert until it is correlated across the ecosystem, which is precisely what DecryptAds automates.

The practical security applications are significant. DecryptAds can help analysts trace the source of malicious advertisements pushing malware, identify ad networks hosted in adversarial nations, and detect the growing wave of AI-generated spam websites and mobile apps that flood ad exchanges. As the platform notes, "supply-chain integrity issues rarely live in a single file"—they emerge from broken cross-references between ads.txt and sellers.json, cloned declaration sets across unrelated domains, and seller removals that only make sense when analyzed across multiple exchanges. A query for ESPN.com alone returns 143 advertising partners and 19 registered data broker domains harvested from its ads.txt and app-ads.txt files, illustrating just how sprawling the modern adtech supply chain has become.

A key driver behind the resulting transparency is recent state-level legislation. California, Oregon, Texas, and Vermont have passed laws requiring data brokers to register when they buy or sell information on consumers in those states, making the identities of these firms far more accessible than before. For privacy-conscious users, this kind of ecosystem-level visibility is increasingly important—you can verify your own exposure by running a browser fingerprint test to see how identifiable your device is, or perform a DNS leak test to confirm your traffic is not being intercepted by intermediaries. For a broader overview of where your data may be flowing, a privacy checkup can pinpoint weak points in your daily browsing setup.

DecryptAds represents a shift toward treating advertising infrastructure as a legitimate security concern rather than a background nuisance. Edwards and his team are betting that journalists, researchers, and everyday users will embrace a tool purpose-built for privacy and threat intelligence use cases that have historically been underserved. As adtech networks grow more complex and AI-driven content farms proliferate across exchanges, having a free, searchable window into the declared relationships between publishers, ad networks, and data brokers is a meaningful step toward accountability in an industry that has long resisted scrutiny.