The full read-out
The score above tells you how masked you are. This is the raw material it is built from, six groups of signals your browser hands over on every page load, read live from your own device.
The address every site sees, and what the network registry says about the organisation behind it.
The address websites see
Where it places you
Your clock against the clock the network believes you keep. This is the cheapest spoof to make and the easiest one to catch. Your clock reads —.
Your clock
The network's clock
Which client is actually talking to the server, and how much of it the user-agent string still gives away.
Browser
Machine
Screen geometry and the display preferences the browser publishes on your behalf. Resizing the window changes the viewport rows live.
Screen
Preferences
The rendering stack underneath the browser. Four independent hashes of how this machine draws and plays audio — the core of a cookie-less fingerprint.
Graphics hardware
Fingerprint hashes
What can be stored on this device, what the browser volunteers about your intent, and the settings that quietly single you out.
Storage & permissions
Signals
74 signals, every one read from your own browser or a single clearly-labelled IP lookup. Nothing is stored, and nothing is sent anywhere except that lookup.
Six read-outs, one at a time
The list above is everything at once. These six take one question each and answer it properly: which signals actually make you identifiable, what WebRTC told the network about you, how the connection measures up, what your canvas fingerprint literally looks like, which fonts you have installed, and what permissions this browser has already given away.
All the tests, in three groups
This page is for reading; the test pages are for running. Every test belongs to one of three groups, listed in full on the tests page with what each one measures.
What a page learns before you click
Every website needs to know a few things to work, how big your screen is, which fonts it can use, what your browser supports. Your browser answers all of it automatically, and it answers in a hurry.
The trouble is that the full set of answers is often unique enough to recognise you again later, with no cookie and no login. None of these readings is a secret on its own. What identifies you is that there are dozens of them, and the combination narrows the crowd fast.
These tools let you see those answers the way a tracker does. Start with the fingerprint test for the big picture, then work through the pieces, and check whether a VPN, private window or privacy extension is doing what you think it is.
The first 200 milliseconds
Your address and your TLS handshake
Before a byte of HTML: your IP, the network that owns it, and roughly where it sits.
The headers you volunteered
User agent, accepted languages, client hints. Cheap to send and hard to stop.
Screen, timezone and fonts
Readable in the first few lines of script, no permission involved.
Canvas, WebGL and audio
The expensive ones. Your GPU draws a glyph and renders a silent tone, and the output is hashed.
One identifier
Everything above, folded into a single string that follows you between visits.
What a VPN changes, and what it does not
A VPN does one job well: it moves the address your traffic appears to come from. That is genuinely useful, and it is most of what people expect from it.
It does nothing at all to your browser. Your screen, GPU, fonts, timezone and language are read from your device, not from your connection, so they survive a VPN untouched. Two people sharing one VPN server still look completely different to anyone fingerprinting them.
Worse, a badly set up VPN can stand out more than no VPN at all. If your address says Amsterdam while your clock still says Karachi, the disagreement is the tell, and it is a one-line check. The timezone test and the WebRTC leak test both look squarely at that gap.
A VPN, itemised
It changes
- Your public IP address
- The city and country it maps to
- The network that announces it
It does not
- Your timezone or clock
- Screen, GPU, fonts, languages
- Cookies already set on your device
How the score at the top is worked out
It starts at 100 and only ever goes down. Nothing adds points, a reading either agrees with your connection or it does not, and every deduction is printed beside its row so you can check the arithmetic yourself.
That means a plain, unremarkable browser scores 100. The number only falls when something actually contradicts something else, so a score of 78 is not “78% anonymous”. It is 100 minus the points the failing rows cost.
It also means the figure is a consistency check, not a verdict on how hidden you are. Someone with an ordinary home connection and no privacy tools at all can score 100, because there was nothing to disagree with. If you want a reading of how identifiable you are rather than how consistent you look, the entropy figure in the read-outs above is the one to watch.
What costs what
- Timezone disagrees with your IP −22
- WebRTC names an address you are not browsing from −20
- Automation traces in the browser −18
- Address belongs to a hosting network −16
- Clock does not match that timezone −14
- Do Not Track, cookies, ad blocker context only
- Language region vs country context only
A private window clears cookies. It does not clear your fingerprint.
Private browsing is good at the job it was built for: no history, no cookies left behind, no session waiting to be picked up again. It was never built to change what your browser looks like.
Your screen, GPU, fonts, timezone and language are read from the device every time a page loads. A private window changes none of them, so the fingerprint it produces is the same one your ordinary window produces. To anyone fingerprinting, the two windows are the same visitor.
That is why clearing your cookies feels decisive and often is not. The cookie is the part you can see and delete; the fingerprint is the part that quietly survives the delete. The cookies versus fingerprinting article walks through the mechanism, and the fingerprint test shows you your own.
What a private window does
Clears
- Cookies and site data
- Browsing history
- The signed-in session
- Cache and local storage
Leaves alone
- Screen size and GPU
- Installed fonts
- Timezone and language
- Your IP address
Built to be private, fast and honest
Your data stays with you
Browser and privacy tests run entirely on your device. Results are shown to you and discarded when you close the tab, there is no visitor database here to store them in.
No sign-up, no paywall
Open a test, read the answer. The pages are static and load fast on a slow connection, and every tool is free with no account.
The method is written down
Each test explains what it measures and how, including where a figure is an estimate. If you disagree with a choice, you can at least see it.
From the blog
All articlesHow Advertisers Build a Profile of You Across the Web
An identifier, an auction, and a set of segments attached to it. Here is the chain that turns scattered page views into a profile, and what actually breaks it.
Michelle JohnsonWhat Incognito Mode Actually Hides, and What It Does Not
Private browsing clears local traces, not identity. Here is what incognito does, what it leaves untouched, and why your fingerprint is unaffected either way.
Michelle JohnsonCan Websites Tell You Are Using a VPN? The Honest Answer
Usually yes, but by inference rather than detection. Here are the tells a site can use, and which ones a residential proxy does and does not fix.
Michelle Johnson