Can you be followed across the web?
Most fingerprinting tests tell you how rare your browser is. That is only half the question. A browser that looks unusual but changes every visit cannot be tracked — one that is unremarkable but never changes can be. This test measures both, and shows you which of your signals actually held.
—
—
but shifting
hard to follow
and consistent
easy to follow
and shifting
well hidden
but consistent
blends in
Have we seen you before?
This is the measurement that matters. A fingerprint is only useful to a tracker if it still matches on your next visit.
—
—
Your signals, grouped
Grouped because the individual numbers are not independent — your platform, font list, GPU renderer and screen size are largely the same fact restated. We measure entropy within a group jointly, and only add up across groups. Expand any row for the raw values and what to do about them.
How this differs from other fingerprint tests
The “bits of identifying information” number is usually meaningless
If a test says you are unique among N browsers tested and then reports log₂(N) bits, that number is a property of their database, not of your browser — every unique visitor gets the identical figure, and it drifts as their traffic changes. We show the modelled entropy and the corpus ceiling separately, so you can see when one is limiting the other.
Rarity is not trackability
Brave and Safari deliberately randomise canvas and audio output. On a rarity-only test that shows up as “your browser is unique” — scored as a failure, when it is the protection working. We score stability as its own axis, so randomisation lands where it belongs.
We compare you to your peers, not to everyone
“One in 8 browsers run macOS” is true and useless. What matters is how well you hide among people who already look like you. Every group is scored against your cohort as well as the whole corpus.
We measure the network layer, which no extension can hide
Your TLS ClientHello produces a JA4 fingerprint, and your HTTP headers arrive in an engine-specific order. Both are generated by your network stack before any script runs. A privacy extension that rewrites your User-Agent does not touch either — so a mismatch between what you claim and what your TLS stack says is itself a strong signal.
We test the surfaces that actually carry entropy now
Chrome froze navigator.plugins and reduced the User-Agent string years ago; tests still reporting those are measuring nothing. The entropy moved to Client Hints, storage.estimate() (derived from your free disk space), sub-pixel font metrics, WebGPU adapter limits, codec support and ICU behaviour. We test those.
Method and data
Short version: we store counts and hashes, never raw identifiers.
Signal values are stored as truncated SHA-256 hashes and integer counters. We do not store your IP address, and we do not use any third-party tracker to do it. Your visit history is keyed by a hash of your browser's own stable signals — which is precisely the mechanism this site exists to demonstrate.
Entropy per group is log₂(corpus ÷ how many share your value). Groups are summed assuming independence between groups, which is an approximation we make visible rather than hide: where the modelled total exceeds log₂(corpus), we say so.
There is a JSON API at POST /api/scan, corpus stats at /api/stats, and a plain-text network-layer summary at /txt for curl.
Built by Brilliant Hosting
We run UK web hosting that does not sell your visitors' data. See what we do →