Browser Fingerprint Test
A browser fingerprint is the combination of signals every website can read about you without asking: your IP address and where it points, your timezone and languages, your screen, graphics chip, fonts and a set of quiet preferences. This test reads them all in your own browser and writes the portrait a site sees in its first second — then checks whether the story is consistent. Start with what websites know about you, cross-check a disguise with VPN leaks and disguise checks, and see how a privacy test keeps no data. If you work with captured traffic instead, the HAR Analyzer reads those files locally too.
Last updated:
Your portrait, as a website sees it
Your fingerprints
Each fingerprint is identical on every site you visit — that is what makes it a fingerprint. A VPN changes your address; it does not change any of these.
Does the story hold together?
These checks compare the layers against each other. A mismatch is not proof of anything on its own — travellers and remote workers mismatch honestly — but it is exactly what disguise-detection looks for.
Tests that wait for your click
Nothing in this section runs until you press its button. Each test asks for something a site could only get by asking — tracker scripts, a precise location, motion sensors — so you can see the request before you grant it.
Test tracker blocking
Loads the seven best-known tracker scripts the way an ordinary page would, and reports which ones your browser or blocker stopped. Nothing is sent to those services by this page beyond the script request itself.
Test precise location
Asks the browser for your precise position, exactly as a site would. The browser will ask you first; the result is shown here and sent nowhere.
Test motion sensors
Listens for three seconds to the motion and orientation sensors a site can read on some devices. On some systems the browser asks for permission first.
Every signal, one by one
Every value a site can read, grouped by layer, with the mechanism that exposes it. “Doesn’t say” means your browser withholds or coarsens that value — which is itself a privacy feature.
How common is your setup?
With your permission, this page sends a handful of coarse values (operating system family, browser family, GPU string, timezone, language, screen size and the three fingerprints) to an anonymous counter. It returns how many of today’s runs share each value. No address, no full signal table and no identifier is sent, and the counter keeps only tallies.
Everything on this page is read in your browser. The only server requests are to three named endpoints — /api/check/whoami (what our server sees), /api/check/etag (a recognition check) and /api/check/fingerprint-count (anonymous tallies) — and nothing you see here is stored on a server.
How this test works
The portrait at the top is assembled from the same readings listed below it, and every filled phrase in it names the signals it came from — hover or tap a phrase to see its sources. The connection layer comes from our own checker endpoint, which reports what a server sees when your browser connects: the address, its geolocation and network, and the TLS and HTTP versions of the connection. Three outside trace endpoints (Cloudflare, ChatGPT and Claude) show the address other networks see, which is how split tunnels and relays show up. WebRTC is read because it can expose addresses the connection layer hides, and a DNS echo shows which resolver answers for you and where it appears to sit.
The device layer is read with the ordinary JavaScript APIs any page can use: user agent and client hints, screen and window geometry, WebGL renderer strings, canvas and audio rendering probes, a font measurement list, codec support and preference media queries. None of it needs a permission prompt, which is the point of showing it: this is what “without asking” looks like in practice. Where a browser withholds or coarsens a value, the row says so rather than guessing.
What this test deliberately does not do
It does not guess your age, because nothing a browser exposes can support that guess — the confident age brackets in ad profiles come from behaviour tracked across sites, not from device readings. It does not store your portrait: the readings live in this page, in your browser, and are gone when you close it. The only things planted locally are the recognition markers described in the persistence section — an ETag check, storage traces and a last-visit record — and the buttons above delete them. The anonymous counter, when you allow it, receives only the coarse values listed there and keeps tallies, never a table of visitors.
Treat mismatches as information, not verdicts. A timezone that disagrees with an IP address can mean a VPN, a work laptop imaged in another country, or a traveller with a phone set to home time. The checks exist because disguise tools change one layer and forget the others; seeing all the layers side by side is what lets you judge whether your own setup tells the story you intend it to tell.
Key terms
| IP address | The address your connection presents to every server. It locates your network exit approximately and names the organisation that owns the block. |
| Browser fingerprint | A stable identifier computed from many device and browser signals. It survives cookie deletion because nothing needs to be stored on your machine. |
| Canvas | A drawing surface the browser renders with your GPU, drivers and fonts. Tiny rendering differences make the result measurably distinctive. |
| WebRTC | The browser’s real-time communication stack. Its ICE negotiation can reveal public and local addresses a plain connection view hides. |
| ETag / cache ID | A validator a server sends with a resource. If your browser returns the same tag later, the server can recognise the browser without any cookie. |
| Anonymous counters | Tallies that count how often a value occurs without keeping who submitted it. They answer “how common is this?” and cannot list the visitors behind the numbers. |
| Global Privacy Control | A browser signal (navigator.globalPrivacyControl) stating you object to the sale or sharing of your data. It carries legal weight in some jurisdictions. |
Frequently asked questions
What does this page actually do?
It reads, in your browser, the signals any website can read — connection, device, graphics, preferences and persistence markers — and displays them as a portrait, a signal table, four fingerprints and a set of consistency checks. The only server contact is with the three endpoints named in the privacy line above, plus the outside trace and DNS-echo services the network section uses. Three further tests (trackers, precise location, motion sensors) run only when you press their buttons. The fingerprints it computes are hashes of stable signal combinations — canvas and WebGL rendering, audio, fonts, screen, timezone — recomputed on every visit, which is why the same browser is recognised after cookies are cleared; see the key terms above.
How do the city and home guesses work?
The city is the geolocation of the IP address a server sees — the city of your network exit, which may be your provider’s gateway rather than your home. The home guess is separate and weaker: it combines your browser’s language list with your timezone to name the country those settings most often belong to. When the two disagree, the consistency checks say so; travel, remote work and VPNs all produce honest disagreements.
Why can’t the test guess my age?
Because no exposed signal carries it. Browsers do not report a birth date, and device model, screen size or installed fonts do not map to an age in any defensible way. The age brackets attached to advertising profiles are inferred from behaviour — what you read, watch and buy across many sites — not measured from your device. A test that printed an age would be inventing it, so this one states plainly that age is unknowable from these readings.
Do you keep any of this?
No. The portrait and signal table exist only in this page in your browser. Our whoami endpoint answers what the server sees and keeps nothing; the etag endpoint sets a recognition tag so the page can show you ETag tracking working, and the tag identifies a browser, not a person; the fingerprint-count endpoint keeps only anonymous tallies of coarse values, and you can opt out — Global Privacy Control opts you out automatically. The named outside services (Cloudflare, ChatGPT, Claude and the DNS echo) see the same requests any visit to them would produce. Button-gated tests run only on your click and their results stay on this page.
Why do some rows say “doesn’t say”?
Because the browser withholds, coarsens or has not implemented that value. Safari and Firefox deliberately report less than Chromium browsers in several places, some values need an API your browser lacks, and a few are empty because the underlying feature is off. The test prints “doesn’t say” rather than filling the gap with a guess — an absent signal is a real, and often privacy-protecting, result.