What does your browser reveal about you?
Every website can read dozens of details about your browser and device without asking. Combined, they often form a fingerprint that can recognize you across sites even if you clear cookies.
Nothing is collected until you press the button. The check runs 15 categories of tests on this page, twice, and shows you every value it found. Nothing is sent anywhere.
What your browser reveals
Bits are rough estimates of how much each value narrows down who you are (each bit halves the crowd you blend into). Open any row's “What is this?” for an explanation, and tick “What if this were hidden?” to see how much that signal matters.
Reduce your fingerprint
Export your report
Exporting is the only way this data leaves the page, and only if you do it. The JSON file includes every signal, the estimate method version, and the exact input to the fingerprint hash, so you can verify the hash yourself.
Compare two reports
Export a report from two browsers, or from the same browser before and after changing a setting, and load both here to see exactly what differs. Files are read on this page and never uploaded.
How to verify we send nothing
You do not have to take our word for it.
- Open your browser's developer tools (F12, or ⌘ ⌥ I on a Mac) and choose the Network tab.
- Reload the page. You will see only this site's own files: the page, one script, one stylesheet and the icon.
- Clear the list, then press Check my browser. The list stays empty.
-
In the Console tab, try
fetch('https://example.com'). The browser refuses it, because this page's Content-Security-Policy forbids every outgoing connection:
default-src 'self';
script-src 'self';
style-src 'self';
img-src 'self' data:;
font-src 'self';
connect-src 'none';
object-src 'none';
base-uri 'none';
form-action 'none';
frame-ancestors 'none'
The key part is connect-src 'none': it blocks fetch, XHR, WebSockets and beacons, so the page
could not send your data even if it tried. The policy is set both as a response header and as a
<meta> tag you can read in the page source.
The fine print
- Loading any web page sends your IP address and user agent to its server. This site is static files on Cloudflare, with no analytics, no cookies and no third-party scripts. The results of the check are never sent.
-
The WebRTC test gathers network candidates with no STUN or TURN server configured, so it contacts no
remote host. Your browser may register a random
.localname on your local network, as it does for any WebRTC page. - The storage test writes a throwaway value to each storage type, reads it back and deletes it immediately. Nothing else is stored unless you tick “Remember this result on this device”, which keeps only the hash and a date. Unticking it deletes them.
- All code is open source: read it on GitHub.