What websites see about you
In short
The analysis runs the leak tests (WebRTC, DNS, the other address family), reads the network signature of your connection and works out your browser's fingerprint, to tell you what a site can infer from them. It all happens in your browser or with ip.bzh, and nothing is kept.
What to do?
Everything on this page, as text or JSON, to compare or to ask for help. It contains your IP address: read it before posting it.
What a site can infer
Sites, especially anti-fraud and advertising systems, cross-check all of this. Here is what they can conclude.
Leaks
VPN or proxy hints
- Network Your address belongs to Amazon.com, Inc., a host, CDN or VPN provider, not an access provider: VPN or proxy likely.
Browser consistency
Protections and habits
Not run yet.
Browser fingerprint
A site can combine all of this into an identifier, without any cookie: it stays the same in private browsing and after you clear your data. Open this page in a private window to compare. The fingerprint is worked out in your browser; it is neither sent nor kept.
Not run yet.
Identifier
Without the scrambled elements
Cross-browser identifier
Your browser scrambles canvas drawings, from one read or one site to the next: they cannot be used to track you.
What a tracker would keep: it leaves out the elements your browser scrambles, and the rest still recognises you from one visit to the next.
Compare from one browser to another
Note these short hashes, then open this page in another browser on this device: every element whose hash is the same is a point in common a tracker can use.
| Element | Value | Hash |
|---|
Fonts do not count in the identifier: each browser finds them its own way (restricted font visibility in Firefox, font substitutions on Linux). They remain a clue for a tracker.
Your fingerprint over time
ip.bzh keeps nothing. If you want, this fingerprint can be kept in your browser, in ip.bzh's local storage (localStorage, key “ipbzh-fingerprint”), on this device only: the identifiers and a hash of each element, not their values. It is never sent to the server. On your next visit, this page will tell you what has changed. “Forget” deletes it, as does clearing this site's data in your browser.
Element by element
| Element | Value | Risk | Hash |
|---|
The risk is an estimate: each element is weighted by the average entropy measured by published studies (EFF Panopticlick, AmIUnique), adjusted to your values, and the total is halved because the elements are linked to each other. ip.bzh keeps no fingerprints to compare you with other visitors: this is an order of magnitude, not a measurement.
To blend into the crowd: Tor Browser, Mullvad Browser, Brave, or Firefox with enhanced tracking protection. Adding extensions often makes the fingerprint more unique.
Browser, version and system, sent with every request. Keep your browser up to date: an old version is rarer. Changing the User-Agent by hand shows (see Consistency).
The languages set in the browser, in order. One or two common languages blend in; a long or unusual list stands out.
Your system's time zone. It gives the region away even behind a VPN; Tor Browser and Mullvad Browser report UTC for everyone.
Screen size, usable area, colour depth and pixel density. A common screen at 100 % zoom identifies less; resistFingerprinting reports a standard size.
Number of processor cores and approximate memory. Hard to change; Brave and resistFingerprinting report standard or random values.
The system as JavaScript reports it (navigator.platform). Little to gain by changing it: it must match the User-Agent.
Whether the screen is a touchscreen and how many points it handles at once. Tells the kind of device.
A drawing rendered by your graphics card, its driver and your fonts: one of the most identifying elements. Brave and Safari add noise to it, Tor Browser and resistFingerprinting give a blank or uniform image.
The name of the graphics card and its driver. Firefox and Safari give a generic name; resistFingerprinting hides it.
The 3D features and limits the graphics card supports. They depend on the card and the driver; only anti-fingerprinting browsers make them uniform.
A sound processed by the audio stack, never played: the result varies slightly with the system and the processor. Brave scrambles it.
The fonts installed on the system, among a list tested here. Every font you add sets you apart; resistFingerprinting only exposes the system's default fonts.
The last digits of a few maths functions, which depend on the engine and the system. Few bits, and nothing to do.
Date, number and calendar formats. They follow the language of the browser and the system: keep the defaults.
Display preferences (dark theme, reduced motion, contrast, HDR, pointer). The rarer a preference, the more it sets you apart; accessibility settings are worth keeping all the same.
The audio and video formats the browser plays. They depend on the browser and the system, not on you.
The text-to-speech voices installed. Many voices, or voices in uncommon languages, set you apart; Tor Browser hides them.
The features the browser offers (WebUSB, Bluetooth…). They tell the browser and its version, not much more.
The keyboard layout (Chromium only). It often gives the country away; an uncommon layout sets you apart.
Permissions granted or refused, here or for every site, read without asking. Refusing for every site, rather than granting site by site, identifies less.
How many cameras, microphones and audio outputs, without their names. Tells the kind of device.
Extensions that leave traces in the page. Each one sets you apart: keep only those you need, and prefer what the browser has built in.
Even without JavaScript
Turning JavaScript off is not enough: a mere stylesheet can make the browser load addresses that tell the server the size of your window and screen, your theme, your kind of pointer, your rendering engine and some installed fonts. Here is what ip.bzh learnt that way, without any script.
Not run yet.
ip.bzh kept these values for two minutes only, in memory, without linking them to your address, long enough to show them to you. Another site can keep them, and add them to your fingerprint.
Received by the server
Sent with every request
Your browser hands this to every site without being asked. It is shown here as received, and not kept.
- IP address
- 216.73.217.105
- JavaScript
- Off
- Do Not Track
- Off
- Global Privacy Control
- Off
User-Agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
Network fingerprint
Your system and browser give themselves away by the way they open a connection, even with a modified User-Agent. Read from a connection to port 8443 of this server, then forgotten.
- System (TCP)
- Initial TTL
- MTU
- TCP signature
- TLS client
- JA4
- Key exchange groups
- HTTP/2 client
- HTTP/2 (Akamai)
HTTP headers
- User-Agent
- Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
- Accept-Encoding
- gzip, br, zstd, deflate
- Accept
- */*
- Referer
- https://ip.bzh/pref?r=%2Fen%2Fbrowser%2F&theme=dark
Readable by JavaScript
On top of that, any page can read the following with JavaScript. It is worked out in your browser and sent nowhere.
Browser and system
- Platform
- System version
- Architecture
- Model
- Full version
- Languages
- Time zone
- Regional formats
- Keyboard layout
- Clock precision
Display
- Screen
- Usable area
- Window
- Pixel density
- Colour depth
- Colour gamut
- HDR
- Orientation
- Several screens
Hardware
- Processor
- Memory
- Graphics card
- WebGPU
- Touchscreen
- Audio and video devices
Features and preferences
- WebRTC
- · Test for leaks
- Cookies
- Storage quota
- Built-in PDF viewer
- Automated browser
- Network
- Theme
- Reduced motion
- Increased contrast
- Permissions