What is the difference between noopener and noreferrer?

Question

I am learning about the merits of including rel="noopener noreferrer" for external links.

What is the difference between these two attribute values? When should I use noopener, and when should I use noreferrer?

Solution

rel="noopener" is used so that when a new window is created upon clicking a link, malicious javascript code running in the new window will not access your previous window via the window.opener attribute.

rel=noreferrer is used so that when a user clicks on a hyperlink and is transferred to a new location, no referrer information will be leaked to the destination link. Meaning, it will not be possible for the destination to know where that user came from.

You can find more information about both here and more about no referrer here

Comments

[Maximillian Laumeister]

Related: Do “noopener noreferrer” links count as backlinks?

[Manngo]

OK, I think I see what’s happening. The window is a reference to the actual browser window (or tab) parenting the link, while the referrer is a string with the URL of the parent document. The opener is the one likely to get you into trouble with malicious JavaScript code. According to WHATWG, noopener is implied in noreferer for historical reasons.