Everything a single web page can work out about the browser, device and person that requested it. The plain-English findings come first — each expands to the exact values behind it — and the complete field-by-field record follows.
Every value is computed and displayed locally. Nothing is transmitted, and no part of this page contacts another company.
Findings
4
Details observed
42
Fields checked
52
Tables
4
Collected in
…
At
…
In plain English
What this page worked out about you, in the order it matters. Every statement expands to the exact values it came from.
Where you are
Your network address is visible to every site you open.
On a public site this address is matched against a commercial database and becomes a city, an internet provider, often an employer. This copy runs on your own machine, so the address below is your loopback; on the open web it would be the real one. No permission is ever requested for it.
Even if you faked your browser identity, the giveaway is the order.
Every browser sends its request headers in its own fixed order. Changing the user-agent string does not change that order, so a site can tell what you really are regardless of what you claim. The same holds at the network layer below this one.
Do Not Track was a polite request that websites were free to ignore, and they did; it has largely been removed. Global Privacy Control replaced it and does carry legal weight in some places, but it is off by default in most browsers.
Browsers tell each site which page you were on immediately before. Follow that across enough sites, which is what embedded trackers do, and the trail becomes a browsing history.
One measurement needs your participation. The result appears in place, below the box.
Type one sentence
no permission needed
Type the sentence below. This page measures the rhythm, not the words, then saves the pattern — type it a second time and it will say whether the same person is at the keyboard.
thequickbrownfoxjumpsoverthelazydog
0 / 43 characters100% accurate0 wpm
Everything above this point needed no permission.
Not one prompt was shown, and nothing you did granted consent. These are the capabilities that do ask first — press one to see what a single approval hands over.
Every detail, as collected
The findings above are derived from these 4 tables. Field names carry a definition where one helps; anything your browser withheld is grayed out.
Your browser sends all of this by itself, on every request, whether or not the page contains a single line of JavaScript. Blocking scripts does not stop it.
What your browser volunteered
HTTP Request Headers
12 reported
Every header the browser attached to the request for this page, read server-side. This is what a site knows before one line of JavaScript runs.
HTTP Request Headers
Field
Value
accept
*/*
accept-encoding
gzip, br, zstd, deflate
host
sessioncontext.org
user-agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
x-forwarded-for
216.73.216.45, 152.233.47.66
x-forwarded-host
sessioncontext.org
x-forwarded-port
8080
x-forwarded-proto
https
x-railway-edge
jfk1
x-railway-request-id
_EM7ttINRISy87mC9o6EoQ
x-real-ip
216.73.216.45
x-request-start
1789179781200
Client Hints Received
1 reported
This server sends Accept-CH and Critical-CH asking for high-entropy hints — processor architecture, exact browser build, device model, color-scheme preference. The browser then volunteers them on every subsequent request, no script required.
Client Hints Received
Field
Value
no client hints received
reload once — the browser must see the server's Accept-CH before it sends them
The network connection underneath
Connection & Protocol
11 reported
Facts read from the TCP socket, below the HTTP layer. This deployment sits behind a hosting proxy, so the socket here belongs to that proxy and the headers have been re-emitted by it: the ordering below is the proxy's, not your browser's. Run the site directly, with no proxy in front, and this section reports your browser's own header order — a passive fingerprint that survives user-agent spoofing.
Connection & Protocol
Field
Value
What it means
HTTP version
1.1proxy to server; your browser likely negotiated HTTP/2 or /3 at the edge
proxy to server; your browser likely negotiated HTTP/2 or /3 at the edge
transport
no (plain HTTP)the proxy terminated TLS; your connection to it was encrypted
the proxy terminated TLS; your connection to it was encrypted
remote address
::ffff:100.64.0.12the proxy's address, not yours
the proxy's address, not yours
remote port
21658the proxy's port
the proxy's port
address family
IPv6
local (server) address
::ffff:10.243.65.220:8080
requests on this TCP connection
1keep-alive reuse
keep-alive reuse
bytes read on socket
453
header count
11
raw header order
Host, User-Agent, Accept, Accept-Encoding, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, X-Railway-Edge, X-Railway-Request-Id, X-Real-Ip, X-Request-Startre-emitted by the proxy — not your browser's own order
re-emitted by the proxy — not your browser's own order
request line
GET /
Server-Derived Context
18 reported · 10 not
What the server infers from the request. No external lookup is performed — no IP-geolocation service, no analytics endpoint. Nothing about this session leaves the machine.
Server-Derived Context
Field
Value
client IP (x-forwarded-for)
216.73.216.45your real address, forwarded by the proxy
proxy chain
216.73.216.45, 152.233.47.66
x-real-ip
216.73.216.45
Host requested
sessioncontext.org
User-Agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
Whether this site can pick you out of a crowd and know you are the same person who visited before — without you logging in, and without relying on cookies.