Before you move Zcash between a transparent and a shielded address, see how many earlier transactions look like yours. Pick a direction and a shielded pool, type an amount. Runs entirely in this page, on a frozen sample of public mainnet data.
Of 17,739 unshields in the last 14 days of this sample, 1,412 (8.0%) had exactly one earlier shield or move of about their amount into the same pool in the 14 days before them. One candidate for an observer who matches amounts, not proof of a link.
This page cannot send anything: its Content-Security-Policy blocks all network requests. Check DevTools > Network.
Your amount is not stored and not put in the URL.
What this page cannot protect. If you opened it from GitHub Pages, GitHub sees your IP address like any website you visit, but never your amount: the amount stays in this page. Browser extensions can read any page you open, including what you type here, so the strongest option is the command line tool, or this file downloaded and opened offline in a private window with extensions turned off.
Do not send several chunks at the same time or to the same address; do not unshield the exact amount you shielded; waiting helps.
How it works: an observer who sees an entry into a shielded pool (a shield, or a move from another pool) of about your amount followed by an unshield of about your amount from the same pool, allowing for the fee, can guess they belong together; recent matches count fully and matches older than 14 days count half. The crowd is the number of such entries into your pool; entries into the other pools are not counted, because they are linkable only through a visible pool move. "Not sure" checks every pool the transaction can involve and shows the worst: all three for an unshield, Sapling and Ironwood for a shield (from NU6.3 on no value may enter Orchard, ZIP 258, so a shield cannot go into it). GREEN (a weighted crowd of 10 or more) means a big crowd for amount and timing only, not "private". NO MATCH means no entry of about that amount into the pool in the window, so amount matching cannot tie this unshield to a shield in it. An amount with 5 or more decimals is easy to recognise later, so round amounts blend in better.
Covers amount + timing within one pool. Not covered: address reuse (use the command line tool with --to), wallet/fee fingerprints, your IP when your wallet broadcasts (use Tor in your wallet), the z->z graph, links through pool moves beyond their amounts, off-chain records. The sample is a frozen copy: the command line tool syncs fresh data and cuts its own network access before it looks at your amount.