- Findings
- 4
- Fields reported
- 48
- Fields checked
- 55
- Tables
- 4
- Collected in
- —
- At
- —
In plain English
What this page worked out about you, in the order it matters. Every statement expands to the exact values it came from.
Collecting
None of this asks your permission. The findings appear as soon as the last pass lands.
- Reading the browser, screen and document
- Storage, network, devices and permissions
- Fingerprinting graphics, audio and performance
- Reducing it all to one identifier
How identifying is any of this?
A bit of entropy halves the population. Nineteen bits distinguishes one person in half a million; thirty-three would distinguish one person on earth.
This page will not tell you that you are “one in 286,777”, because that number requires a database of other visitors to compare you against — and keeping one would make this page the thing it is arguing about. What follows is what researchers measured when they did keep one: entropy per signal across 118,934 browsers, where the most any single signal could contribute was 16.9 bits.
- List of pluginsweaker since11.1 bitsThe strongest desktop signal in 2016, and almost worthless now: browsers froze the plugin list to a fixed set precisely because of results like this one.
- User agentweaker since9.8 bitsStill substantial, but reduced since: Chrome and Safari now freeze most of the string. The version detail moved to client hints, where a server has to ask for it.
- List of fontsweaker since8.4 bitsMeasured through Flash in the original study. Width-measurement detection, which this page uses, sees fewer fonts — but the permission-gated API sees them all.
- Canvas renderingstill holds8.3 bitsAmong the highest-entropy signals then and now. Firefox and Safari have since added randomization; Chrome has not.
- Content languagestill holds5.9 bitsYour ranked language list. Unchanged since the study, and sent on every request whether or not the page runs any script.
- Screen resolutionstill holds4.9 bitsDisplay geometry, including color depth. Unchanged, and now joined by device pixel ratio and refresh rate.
- List of HTTP headersstronger since4.2 bitsWhich headers you send, in which order. Client hints have added more of them since 2016, not fewer.
- Timezonestill holds3.3 bitsUnchanged, ungated, and enough on its own to place you in a region.
- Platformweaker since2.3 bitsNow frozen alongside the user agent in most browsers.
- Content encodingstronger since1.5 bitsWhich compression formats you accept. Support for newer ones, such as zstd, dates the browser.
- Accept headerstill holds1.4 bitsThe content types you will take, with their quality values.
- Do Not Trackweaker since0.9 bitsWorth little then, and less now that browsers have removed it. Turning it on made you marginally rarer, which was always its problem.
- Local storage availablestill holds0.4 bitsNearly everyone has it. Its value is in what it stores, not in its presence.
- Cookies enabledstill holds0.3 bitsThe least informative thing on this list: almost nobody turns cookies off.
Adding these gives 63 bits, which would identify one browser in 7 quintillion — an absurd figure, and a useful warning. Entropy is only additive when signals are independent, and these are heavily correlated: a machine reporting a Retina screen is more likely to report Apple fonts and an Apple graphics chip. The real combined figure is far lower, and no honest page can compute it without the database this one refuses to keep.
- Laperdrix, Rudametkin, Baudry — “Beauty and the Beast”, IEEE S&P 2016 — 118,934 browsers via amiunique.org; normalized Shannon entropy per attribute.
- Eckersley — “How Unique Is Your Web Browser?”, PETS 2010 — 470,161 browsers via Panopticlick; the study that established the method.
Every detail, as collected
The findings above are derived from these 4 tables. Field names carry a definition where one helps; anything your browser withheld is grayed out.
Your browser sends all of this by itself, on every request, whether or not the page contains a single line of JavaScript. Blocking scripts does not stop it.
What your browser volunteered
HTTP Request Headers
15 reportedEvery header the browser attached to the request for this page, read server-side. This is what a site knows before one line of JavaScript runs.
Client Hints Received
1 reportedThis server sends Accept-CH and Critical-CH asking for high-entropy hints — processor architecture, exact browser build, device model, color-scheme preference. The browser then volunteers them on every subsequent request, no script required.
The network connection underneath
Connection & Protocol
11 reportedFacts read from the TCP socket, below the HTTP layer. This deployment sits behind a hosting proxy, so the socket here belongs to that proxy and the headers have been re-emitted by it: the ordering below is the proxy's, not your browser's. Run the site directly, with no proxy in front, and this section reports your browser's own header order — a passive fingerprint that survives user-agent spoofing.
Server-Derived Context
21 reported · 7 notWhat the server infers from the request alone. No external lookup is performed: no IP-geolocation service, no analytics endpoint, no third party of any kind. None of these values is recorded — the two that are, the ETag and the CSS probe, say so in their own tables.
Whether this site can pick you out of a crowd and know you are the same person who visited before — without you logging in, and without relying on cookies.
Cross-site tracking
Take it back
This page wrote one identifier into seven places on your machine, and the server put an eighth into your browser’s cache. Writing it eight times is the point: clearing one does not clear the rest, and whichever copy survives restores the others on your next visit. Empty them here and watch which one will not go.
This site’s data only, and only on this machine.