What websites know about you
A signal is anything a website can read about a visitor without asking permission: a value your browser hands over as part of normal browsing, a property of your connection, or a preference you set long ago and forgot. No single signal names you, but together they form a portrait detailed enough to recognise you, locate you roughly, and guess how you like to browse. The Browser Fingerprint Test writes that portrait out as one paragraph, so you can read yourself the way a site sees you in the first second of a visit. This article walks through every layer of that paragraph — connection, device, browser and quiet preferences — and ends with what a site still cannot see. It pairs with VPN leaks and disguise checks, which asks whether the portrait matches the story your VPN is trying to tell.
The paragraph comes first
Open any modern website and, before you have clicked, scrolled or typed a character, the page has already assembled a working portrait of you. It knows roughly where in the world you appear to be, what language you probably read, what device class you are holding, how large your screen is, and whether your setup looks ordinary or unusual. None of that required a permission prompt, a login, or a cookie banner. It came from the ordinary negotiation every browser performs to fetch and render a page: the connection itself, the headers that accompany every request, and the JavaScript APIs that exist so pages can adapt to your device.
The paragraph at the top of the fingerprint test exists to make that assembly visible. Instead of showing a table of raw technical values, it writes a sentence you would recognise as a description of a person: someone in a particular city, on a particular network, using a particular browser on a particular kind of machine, preferring a particular language and appearance. Each filled value in that sentence is traceable to its signals further down the page, so you can check not just what the conclusion is but how it was reached. When a value is missing, the paragraph says so honestly — and that absence, as the last section explains, is itself information.
Why does this matter if no single value is secret? Because combination is the point. A screen size alone describes millions of people. A screen size plus a GPU model, a timezone, a language ordering, a list of supported codecs and a network type narrows the crowd dramatically. Sites use that combination for legitimate work — fraud checks, abuse prevention, remembering that a login looks familiar — and advertisers use it to recognise returning visitors even when cookies are cleared. You cannot judge either use until you can see your own combination, which is what the test is for.
What your connection says
The first layer is your connection, and its headline is your IP address. Every server you contact sees it, because it needs somewhere to send the reply. From that one address a site can look up a surprising amount: an approximate geolocation from commercial databases, the autonomous system number (ASN) and organisation that owns the block, and whether the address belongs to a household broadband provider, a mobile carrier, a business, or a hosting company. That last distinction is itself a signal — a visitor arriving from a data-centre range reads very differently from one arriving from a residential street, and fraud systems notice.
Treat the geolocation with care: the city shown is the city of your network exit, not necessarily yours. Databases map addresses to where providers register and route them, so mobile networks, corporate gateways and rural providers routinely place people tens or hundreds of kilometres away, and occasionally in the wrong country. The test improves the picture by asking more than one trace endpoint, because different networks can see different exits — a CDN trace, for example, may reveal the address that edge network observed, which can differ when a proxy, a relay or a split tunnel is involved. Differences between those readings are not errors; they are a map of the paths your traffic actually takes.
The connection also reports its own mechanics: the TLS version and protocol that secured it, and whether it arrived over IPv4 or IPv6. This is exactly the layer a VPN moves — and only this layer. A VPN replaces the IP address sites see with its exit address, so the city, country, ASN and organisation change to the VPN provider’s. It does not change your screen, your fonts, your timezone or your language list. That mismatch — a connection claiming one country and a browser configured for another — is precisely what disguise checks look for, and why changing your address alone is a weaker disguise than it feels.
What your device and browser say
The second layer is the device and browser themselves. The oldest signal is the user agent string, a banner in which the browser announces its family, version and operating system; modern Chromium browsers increasingly freeze that string and move the detail into User-Agent Client Hints, structured values a site can request for model, platform version and architecture. Around it sit the platform name, the number of logical processors reported as hardware concurrency, an approximate device memory figure, and the maximum touch points — individually mundane, jointly a sketch of the class and age of your machine.
Graphics and display add the long tail. Your screen geometry — total size, available size, colour depth and device pixel ratio — describes your monitor and scaling choices. A WebGL probe can read the GPU vendor and renderer string, which often names the exact graphics chip or driver family. Canvas rendering, audio processing and font measurement work similarly: ask the browser to draw a shape, render text or enumerate what it can display, and tiny differences in hardware, drivers and installed fonts produce measurably different results. The test also probes installed fonts indirectly, media devices in aggregate, and which audio and video codecs the browser can play — each a small fact, together a combination few other visitors share exactly.
None of this requires exotic access. These are the same APIs legitimate sites use to serve the right video format, pick a layout that fits your window, or avoid offering a download your system cannot run. That dual use is what makes fingerprinting hard to legislate away: you cannot remove the capability without breaking ordinary adaptation. What you can do is know your own exposure. A rare combination is not wrongdoing, but it does mean clearing cookies does less for your anonymity than you might hope — the device layer re-identifies the same machine on its next visit with no stored state at all.
The quiet preferences
The third layer is quieter: the preferences and settings your browser carries. It reports whether you prefer a light or dark colour scheme, whether you have asked for reduced motion, whether you prefer reduced data or contrast adjustments, and similar accessibility and appearance choices made through the operating system or browser settings. These exist so sites can respect them, and most people set them once and never think of them again — which is exactly why they are stable enough to contribute to a fingerprint.
Language and time are louder. The browser sends an ordered language list — not just your main language but the fallbacks and their priority order — and exposes the timezone your system is set to, along with how dates and numbers are formatted in your locale. A language list of one common entry is unremarkable; a list of three languages in an unusual order, paired with a timezone and a date format, is close to a signature. It also cross-checks the connection layer: a browser set to one region while its IP address claims another is a classic sign of travel, remote work, or a VPN exit chosen in a different country from the machine itself.
Some preferences were designed as privacy requests. Do Not Track and its successor, Global Privacy Control, let the browser signal that you object to tracking or to the sale of your data — and GPC carries legal weight in some jurisdictions, which Do Not Track never did. In practice both are honoured unevenly, and sending them is itself a distinguishing signal, because relatively few visitors do. The same paradox runs through this layer: cookie and storage availability, whether the battery API is offered, which keyboard layout is implied — settings and absences alike describe you, including the ones meant to protect you. The test reports what your browser says and stays silent about values it withholds, so you can see both sides.
What a site still cannot see
For all of the above, the limits matter as much as the reach. Without a permission prompt a site cannot read your name, your exact address, your age, your contacts, your files, your precise GPS location, your microphone or your camera. Geolocation, device access and notifications sit behind explicit browser permissions for a reason, and a well-behaved test — like this one — reads only what is freely offered and asks for nothing. If a random page claims to know your name from your fingerprint alone, it is bluffing or it bought that link from somewhere else.
That somewhere else is the honest caveat. The ad industry’s confident guesses about your age, gender, income and interests do not come from these readings; they come from behaviour joined across many sites and apps — what you search, watch, buy and linger on — assembled into profiles and attached to identifiers over time. The fingerprint’s role in that economy is narrower and more technical: it helps recognise the same browser again so the behavioural record can be continued. Keeping those two things separate matters, because the defences differ: behaviour is governed by accounts, consent and tracking rules, while signals are governed by what your browser chooses to reveal.
Which is why a missing signal deserves respect. When the test says “this browser doesn’t say”, that is a privacy feature working as intended, and browsers differ deliberately here: Chromium-based browsers generally offer more detail, while Safari and Firefox withhold, coarsen or randomise more values, and privacy-focused browsers go further still. Shortening your paragraph is possible — the FAQ below gives practical steps — but the goal should be an informed choice, not invisibility, which no mainstream setup honestly delivers. For how the companion test itself handles the data it reads, see how a privacy test keeps no data: the short version is that your portrait is written in your browser, for you, and reading it should not require trusting us with a copy.