Browser Privacy Check (What Sites See)

About the Browser Privacy Check (What Sites See)

Every website can read a surprising amount about your browser without asking: the user agent, your languages and time zone, the size and colour depth of your screen, the number of processor threads, your accessibility settings, and — by drawing invisibly to a canvas, rendering WebGL and processing sound — values that differ from one device to the next. Combined, they form a fingerprint that can recognise your browser across sites and visits, and unlike a cookie, as the W3C’s guidance on fingerprinting puts it, it cannot be cleared or reset.

This check runs those measurements in your tab and shows each value, what it reveals and how identifying it tends to be. It tells you which protections your browser applies — whether canvas and audio readings come back exact or altered, whether your graphics card is named, whether the Global Privacy Control signal is on — and computes the ID a script could derive. Then it gives advice that follows the W3C’s guidance and EFF’s Cover Your Tracks project. Nothing is stored, and nothing is sent anywhere.

Common uses

• Seeing how much a site can learn about you before you install a privacy extension or change browser.
• Checking that Global Privacy Control is really switched on after enabling it.
• Comparing browsers, private windows and protection settings by their fingerprint ID.
• Showing students, colleagues or family how fingerprinting works, with their own browser.

Passive and active fingerprinting

The W3C note Mitigating Browser Fingerprinting in Web Specifications separates two kinds. Passive fingerprinting uses what your browser sends with every request — the user agent, accepted languages, client hints, your IP address — and cannot be seen from the page. Active fingerprinting runs code in the page to read more: screen and hardware details, fonts, and rendering results. Active fingerprinting can at least be detected and limited by the browser, which is what fingerprinting protections do.

How the rendering fingerprints are made

• Canvas: the page draws text in two fonts, an emoji and blended shapes, reads the pixels back and hashes them. Graphics hardware, drivers, fonts and anti-aliasing all change the result slightly.
• WebGL: the graphics card’s name and limits, read through the WebGL API (the unmasked name where the browser provides it).
• Audio: a tone passed through a compressor is rendered off-screen and its samples summed; the result varies between audio stacks.
• Fonts: the width of a test string is measured in each of about a hundred common fonts against generic fallbacks; a different width means the font is installed.

To see whether your browser defends itself, the check also draws exact solid colours and a constant audio signal: an unprotected browser returns exactly what was drawn, a protected one alters the readings or blocks them.

Global Privacy Control and Do Not Track

Global Privacy Control sends the header Sec-GPC: 1 and sets navigator.globalPrivacyControl to ask sites not to sell or share your personal information. Several US states, California among them, recognise it as a legal opt-out. According to the GPC project, Brave and DuckDuckGo send it by default and Firefox offers it in its settings; extensions such as Privacy Badger add it elsewhere. Do Not Track (DNT: 1) is its predecessor: it never became a binding standard, and few sites act on it.

What actually reduces your fingerprint

EFF’s Cover Your Tracks describes two strategies that work: blend in, as Tor Browser does by making its users look alike, or randomise, as Brave does by changing values per site and per session. Tracker blockers such as Privacy Badger stop some fingerprinting scripts, and blocking JavaScript stops most of them at the cost of broken sites. Faking a single value (a different user agent, say) usually backfires: it makes your combination rarer, not hidden.

Limitations

• The fingerprint ID is computed here from the values shown; real trackers use their own measurements and server-side data such as your IP address, so their IDs differ from this one.
• It cannot say how rare your fingerprint is: that needs a database of other visitors’ fingerprints, which this page does not collect.
• Browsers that change readings per site or per session give the same values twice in a row on the same site. The exact-colour and constant-signal tests detect such alterations; comparing IDs between sites or after a restart is the other way.
• Your IP address is not shown, because reading it needs a server; the What Is My IP tool shows it.

Privacy

Everything is measured in this tab when you press the button and kept only in the page’s memory. No value, hash or ID is stored, uploaded or shared, and nothing is measured before you ask.