What your browser reveals

Two sources, and it is worth knowing which is which

Everything listed on this page arrives in one of two ways, and the distinction matters because it decides what you can do about it.

The first group is sent by your browser with every single request, before any code runs: your address, the user-agent string, the languages you accept, what formats and compression you can handle, which page referred you. A site does not have to ask for these and cannot avoid receiving them — they are how HTTP works. Turning off JavaScript changes nothing here.

The second group is what JavaScript can read once a page has loaded: your time zone, screen dimensions, the number of processor cores, whether the device has a touchscreen, the current connection type. None of this is transmitted automatically; a site has to run code that asks. It usually does.

What we do with all of it is nothing. The values on this page are computed for display and discarded when you leave; we keep no profile, and there is no account to attach one to. We are saying this plainly because in this corner of the web the conventional approach is to present the same list as an alarming discovery and then sell a subscription that fixes one item on it.

The headers, one by one

Your IP address

Unavoidable — it is the return address, and without it no reply could reach you. It identifies your network, not you; what it does and does not reveal is covered on the address lookup page.

User-Agent

A string describing the browser, which is mostly a historical accident. Nearly every browser still begins its user-agent with "Mozilla/5.0" because of compatibility fictions accumulated since the 1990s, so the string is best read as archaeology. It is also being deliberately reduced: browsers now freeze or trim the detail here and offer precise values only to sites that explicitly ask, specifically to make it a weaker identifier.

Accept-Language

Which languages you prefer, which is how a site can be in your language before you choose one. Quietly one of the more identifying items on the list: "English" is shared with a billion people, while a specific ordered list of three languages with regional variants can be rare enough to stand out.

Accept and Accept-Encoding

Which formats and compression methods you can handle. Dull, and used mainly to decide whether to send a modern image format or a fallback.

Referer

The page you came from — famously misspelled in the original specification and never corrected. Browsers have tightened this considerably: by default most now send only the origin, not the full path, when you move between sites, so the days of the exact previous URL leaking everywhere are over.

DNT and GPC

Two attempts at a "do not track" signal, with very different fates — see below.

Protocol version

Whether you arrived over HTTP/1.1, HTTP/2 or HTTP/3. A performance detail, not a privacy one.

Do Not Track, and why Global Privacy Control is different

Do Not Track was a header meaning "please do not profile me", proposed around 2009. It failed completely, and the reason is instructive: it was a polite request with no legal force, so honouring it was voluntary, and it was widely ignored. The standardisation effort was formally wound up in January 2019 having produced no adoption worth the name. If your browser still sends it, essentially nothing on the receiving end reacts.

Global Privacy Control is the same idea with the missing piece attached. It is intended to carry the weight of an opt-out under data-protection law, and in several jurisdictions — California most prominently — regulators have treated it as a legally valid request that businesses must honour. Whether it works still depends on whether the law applies to the site you are visiting, but it is a request with consequences rather than a wish.

Fingerprinting: the honest version

The concern behind this page is not any single value. It is that a large number of individually unremarkable details combine into something rare. Your time zone is shared with hundreds of millions of people; your screen resolution with millions; your exact combination of time zone, resolution, language list, platform, core count and font rendering may be shared with nobody. The canonical study of this, published in 2010, found that the large majority of browsers examined were uniquely identifiable from such properties alone.

Deeper techniques exist and go further: drawing text to a hidden canvas and hashing the result picks up differences in graphics hardware and font rendering; the same trick works with 3D rendering and audio processing. We do not run any of them here, and this page is limited to what a site sees in the ordinary course of loading.

Three things about fingerprinting are usually left out of the scary version of this story:

• It is not free for the site. Building and matching fingerprints takes real infrastructure, so it is done by advertising and fraud-detection companies, not by every site you visit.
• It degrades. Update your browser, plug in a monitor, travel across a time zone, and the fingerprint shifts. It is a probabilistic link, not an identifier.
• Trying too hard makes it worse. This is the part people get backwards. A browser with an unusual user-agent, spoofed screen size and eleven blocking extensions is more distinctive than a default installation, not less. Uniqueness is the thing being measured, and hand-tuned privacy settings are a reliable way to manufacture it.

What actually helps, and what does not

Helps: blending in

A current, default-configured mainstream browser is a genuinely effective strategy, because it makes you look like tens of millions of other people. This is the design principle behind the Tor Browser, which deliberately makes all of its users identical rather than making each one unusual.

Helps: the browser's own protections

Modern browsers block third-party cookies, partition storage per site, and actively resist known fingerprinting scripts. This is where most of the real progress of the last few years has happened, and it costs you nothing.

Helps: fewer extensions

A well-chosen content blocker is worth having. A dozen overlapping privacy extensions are a fingerprint in themselves and frequently break the sites they are protecting you from.

Does not help: private or incognito mode

It keeps history off your own device. It does not hide your address, your headers, or anything on this page from the sites you visit — which is the single most widespread misunderstanding about browsers.

Does not help much: a VPN, on its own

It changes the address a site sees, and that is genuinely useful. It changes nothing else on this page: same user-agent, same time zone, same screen, same fonts. A VPN whose advertising implies otherwise is describing a product that does not exist.

Does not help: changing the user-agent

It swaps one string for another and usually a rarer one, while leaving every other signal intact and often contradicting them — a "Windows" user-agent from a browser that reports Apple hardware in every other field is more identifiable, not less.

A sensible way to think about it

Decide what you are actually trying to prevent. Hiding your address from a website, hiding your browsing from other people on your network, avoiding advertising profiles across sites, and staying anonymous against a determined adversary are four different problems with four different answers, and a tool that solves one usually does nothing for the others.

For most people the useful measures are ordinary: keep the browser updated, use a content blocker, leave third-party cookies blocked, and be aware that the account you are signed into identifies you far more reliably than any fingerprint ever could. The technical detail on this page is worth understanding precisely so that it can be put in proportion — and if you want to check the other half of the picture, the IPv6 test shows which protocols your connection actually uses, and the address lookup shows what your network says about you.