What this page learned about you
Everything a single web page can work out about the browser, device and person that requested it. The plain-English findings come first — each expands to the exact values behind it — and the complete field-by-field record follows.
Almost every value here is measured in your browser and never leaves it. No part of this page contacts another company, and nothing about you is written to disk. Two demonstrations do need this server to remember you for a while, and both say so where they appear. How each technique works →
- Findings
- 4
- Fields reported
- 45
- Fields checked
- 55
- Tables
- 4
- Collected in
- —
- At
- —
In plain English
What this page worked out about you, in the order it matters. Every statement expands to the exact values it came from.
Collecting
None of this asks your permission. The findings appear as soon as the last pass lands.
- Reading the browser, screen and document
- Storage, network, devices and permissions
- Fingerprinting graphics, audio and performance
- Reducing it all to one identifier
How identifying is any of this?
A bit of entropy halves the population. Nineteen bits distinguishes one person in half a million; thirty-three would distinguish one person on earth.
This page will not tell you that you are “one in 286,777”, because that number requires a database of other visitors to compare you against — and keeping one would make this page the thing it is arguing about. What follows is what researchers measured when they did keep one: entropy per signal across 118,934 browsers, where the most any single signal could contribute was 16.9 bits.
- List of pluginsweaker since11.1 bits
The strongest desktop signal in 2016, and almost worthless now: browsers froze the plugin list to a fixed set precisely because of results like this one.
- User agentweaker since9.8 bits
Still substantial, but reduced since: Chrome and Safari now freeze most of the string. The version detail moved to client hints, where a server has to ask for it.
- List of fontsweaker since8.4 bits
Measured through Flash in the original study. Width-measurement detection, which this page uses, sees fewer fonts — but the permission-gated API sees them all.
- Canvas renderingstill holds8.3 bits
Among the highest-entropy signals then and now. Firefox and Safari have since added randomization; Chrome has not.
- Content languagestill holds5.9 bits
Your ranked language list. Unchanged since the study, and sent on every request whether or not the page runs any script.
- Screen resolutionstill holds4.9 bits
Display geometry, including color depth. Unchanged, and now joined by device pixel ratio and refresh rate.
- List of HTTP headersstronger since4.2 bits
Which headers you send, in which order. Client hints have added more of them since 2016, not fewer.
- Timezonestill holds3.3 bits
Unchanged, ungated, and enough on its own to place you in a region.
- Platformweaker since2.3 bits
Now frozen alongside the user agent in most browsers.
- Content encodingstronger since1.5 bits
Which compression formats you accept. Support for newer ones, such as zstd, dates the browser.
- Accept headerstill holds1.4 bits
The content types you will take, with their quality values.
- Do Not Trackweaker since0.9 bits
Worth little then, and less now that browsers have removed it. Turning it on made you marginally rarer, which was always its problem.
- Local storage availablestill holds0.4 bits
Nearly everyone has it. Its value is in what it stores, not in its presence.
- Cookies enabledstill holds0.3 bits
The least informative thing on this list: almost nobody turns cookies off.
Adding these gives 63 bits, which would identify one browser in 7 quintillion — an absurd figure, and a useful warning. Entropy is only additive when signals are independent, and these are heavily correlated: a machine reporting a Retina screen is more likely to report Apple fonts and an Apple graphics chip. The real combined figure is far lower, and no honest page can compute it without the database this one refuses to keep.
- Laperdrix, Rudametkin, Baudry — “Beauty and the Beast”, IEEE S&P 2016 — 118,934 browsers via amiunique.org; normalized Shannon entropy per attribute.
- Eckersley — “How Unique Is Your Web Browser?”, PETS 2010 — 470,161 browsers via Panopticlick; the study that established the method.
Every detail, as collected
The findings above are derived from these 4 tables. Field names carry a definition where one helps; anything your browser withheld is grayed out.
Known before any code runs
How these work →Your browser sends all of this by itself, on every request, whether or not the page contains a single line of JavaScript. Blocking scripts does not stop it.
What your browser volunteered
HTTP Request Headers
14 reportedEvery header the browser attached to the request for this page, read server-side. This is what a site knows before one line of JavaScript runs.
| Field | Value |
|---|---|
| accept | */* |
| accept-encoding | gzip, br, zstd, deflate |
| content-security-policy | default-src 'self'; script-src 'self' 'nonce-4cdec4f9109d4a038dd493e9fb34f1a3' 'strict-dynamic'; style-src 'self' 'nonce-4cdec4f9109d4a038dd493e9fb34f1a3'; style-src-attr 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' data: blob:; font-src 'self… |
| host | sessioncontext.org |
| user-agent | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) |
| x-forwarded-for | 216.73.217.12, 152.233.47.65 |
| x-forwarded-host | sessioncontext.org |
| x-forwarded-port | 8080 |
| x-forwarded-proto | https |
| x-nonce | 4cdec4f9109d4a038dd493e9fb34f1a3 |
| x-railway-edge | jfk1 |
| x-railway-request-id | WyLlXC1jSiulHDEwpHNmDw |
| x-real-ip | 216.73.217.12 |
| x-request-start | 1793079936837 |
Client Hints Received
1 reportedThis server sends Accept-CH and Critical-CH asking for high-entropy hints — processor architecture, exact browser build, device model, color-scheme preference. The browser then volunteers them on every subsequent request, no script required.
| Field | Value |
|---|---|
| no client hints received | reload once — the browser must see the server's Accept-CH before it sends them |
The network connection underneath
Connection & Protocol
11 reportedFacts read from the TCP socket, below the HTTP layer. This deployment sits behind a hosting proxy, so the socket here belongs to that proxy and the headers have been re-emitted by it: the ordering below is the proxy's, not your browser's. Run the site directly, with no proxy in front, and this section reports your browser's own header order — a passive fingerprint that survives user-agent spoofing.
| Field | Value |
|---|---|
| HTTP version | 1.1proxy to server; your browser likely negotiated HTTP/2 or /3 at the edge |
| transport | no (plain HTTP)the proxy terminated TLS; your connection to it was encrypted |
| remote address | ::ffff:100.64.0.9the proxy's address, not yours |
| remote port | 33980the proxy's port |
| address family | IPv6 |
| local (server) address | ::ffff:10.230.225.211:8080 |
| requests on this TCP connection | 1keep-alive reuse |
| bytes read on socket | 453 |
| header count | 11 |
| raw header order | Host, User-Agent, Accept, Accept-Encoding, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, X-Railway-Edge, X-Railway-Request-Id, X-Real-Ip, X-Request-Startre-emitted by the proxy — not your browser's own order |
| request line | GET / |
Server-Derived Context
19 reported · 10 notWhat the server infers from the request alone. No external lookup is performed: no IP-geolocation service, no analytics endpoint, no third party of any kind. None of these values is recorded — the two that are, the ETag and the CSS probe, say so in their own tables.
| Field | Value |
|---|---|
| client IP (x-forwarded-for) | 216.73.217.12your real address, forwarded by the proxy |
| proxy chain | 216.73.217.12, 152.233.47.65 |
| behind a proxy | yesthe socket belongs to the proxy, so header order below is its own |
| x-real-ip | 216.73.217.12 |
| Host requested | sessioncontext.org |
| User-Agent | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) |
| UA length | 103reduced-UA is about 110 characters |
| Accept | */* |
| Accept-Encoding | gzip, br, zstd, deflatecompression support |
| Accept-Language (raw) | not reported |
| preferred language | not reported |
| language count | not reportedranked list, high entropy |
| DNT header | not sent |
| Sec-GPC header | not sent |
| Sec-Fetch-Site | not reported |
| Sec-Fetch-Mode | not reported |
| Sec-Fetch-Dest | not reported |
| Sec-Fetch-User | not reported |
| Referer | none — direct navigation |
| Upgrade-Insecure-Requests | not reported |
| Priority | not reported |
| cookies sent | 0 |
| cookie names | none |
| cookie bytes | 0 |
| server time (UTC) | 2026-10-27T05:45:36.857Z |
| server epoch ms | 1793079936844compare against your own clock |
| server uptime | 3210910.1 s |
| server timezone | UTC |
| runtime | Node v22.23.2 · linux/x64 |
How recognizable you are
How these work →Whether this site can pick you out of a crowd and know you are the same person who visited before — without you logging in, and without relying on cookies.
Cross-site tracking
Take it back
This page wrote one identifier into seven places on your machine, and the server put an eighth into your browser’s cache. Writing it eight times is the point: clearing one does not clear the rest, and whichever copy survives restores the others on your next visit. Empty them here and watch which one will not go.
This site’s data only, and only on this machine.