Fingerprint Observatory

The navigator object exposes your language preferences, CPU thread count, approximate RAM and touch support to every script on the page. Combined, these ordinary-looking values already narrow down your device a lot.

Screen resolution, available workspace, color depth and pixel ratio are readable without any permission. Viewport and display combinations are unusual enough to be a strong fingerprint component.

Your system timezone, locale and UTC offset reveal roughly where in the world you are — even behind a VPN that claims otherwise. A mismatch between IP location and timezone is a classic proxy tell.

Chromium exposes the connection's effective type (4g, 3g...), estimated bandwidth, round-trip time and a data-saver flag. It hints at whether you are on mobile or desktop broadband — and changes as you move networks.

The user agent string announces your browser, its version and your operating system to every script and every server. Browsers are freezing it because it was abused for fingerprinting for decades.

Draws text and shapes on a hidden canvas and hashes the pixels. Subtle differences in GPU, drivers and font rasterization make the result surprisingly stable per device.

Reads the WebGL renderer and vendor strings, often exposing the exact GPU model. Together with the extension count it narrows down hardware and driver.

Dumps the numeric limits the WebGL implementation advertises: texture sizes, viewport dimensions, shader capacities. They vary with GPU, driver and browser, adding many bits of entropy.

Measures the bounding box of an SVG text run. Font metrics and text-shaping differences leak through in fractional pixel sizes.

Measures the exact pixel boxes of text spans at mixed font sizes. Sub-pixel layout rounding differs across browsers, OSes and zoom levels.

The same audio graph rendered offline produces minutely different numbers on different audio stacks. That single number is stable enough to recognize your device across sites — and it is inaudible.

By measuring how a probe string renders against generic font families, a page can tell which fonts are installed without ever asking. Your font set reflects your OS and the software you installed — a solid identifier.

Thread count, a rounded RAM figure, battery level and storage quota are all readable without prompting. Each is coarse on its own; together they describe your specific machine.

WebGPU's adapter info can name your GPU vendor and architecture — the graphics card is one of the most identifying pieces of hardware you own. Browsers are starting to gate it behind permissions for this reason.

Chromium reports the JavaScript heap limit and current usage via performance.memory. The heap limit correlates with the device's total RAM — another quiet hint about your hardware class.

Identifies the JavaScript engine (V8, SpiderMonkey, JavaScriptCore) from error stack formatting and object key ordering — details a spoofed user agent cannot fake.

A page can count your cameras, microphones and speakers without ever starting a capture — labels stay hidden until you grant permission, but the device counts alone already characterize your setup.

The speech synthesis voice list mirrors your OS and its language packs. The exact names and count of installed voices are a stable, rarely considered fingerprint component.

The Media Capabilities API reports whether 1080p VP9, H.264 and AV1 decode smoothly and power-efficiently. The answer pattern depends on your GPU and OS media stack — hardware by proxy.

WebCodecs answers exactly which codec configurations the hardware can decode — VP8, VP9, AV1, H.264 and HEVC. The supported set fingerprints the combination of browser, OS and GPU drivers.

The Keyboard API exposes how physical keys map to characters, which reveals whether you type on QWERTY, AZERTY or QWERTZ — a solid hint at your language and region.

The Gamepad API lists every connected controller with its id, button and axis counts — a niche but stable signal that points at gaming-capable hardware.

Pointer and hover media queries tell a site whether your main input is a precise mouse or a coarse touchscreen, and whether hovering works — an easy desktop-vs-mobile tell.

Checks which modern web APIs this browser exposes. The exact support matrix is a coarse but stable identifier of browser family and version.

Reads Chromium's User-Agent Client Hints, the structured replacement for the UA string, including high-entropy values like architecture and platform version.

Enumerates the state of every well-known permission. The granted/denied/prompt pattern reflects your past choices and persists across visits.

Reads the notification permission state. It persists across sessions and contributes one stable bit to the permission fingerprint.

navigator.webdriver and the globals left behind by PhantomJS, Nightmare and Selenium reveal a browser driven by automation frameworks.

Each browser leaks private browsing through a different API: Chrome caps the storage quota, Safari throws on openDatabase/localStorage, Firefox refuses IndexedDB.

Probes localStorage, sessionStorage and IndexedDB with a write test. Blocked or throwing storage is typical of private browsing modes and hardened configurations.

Checks that the core APIs this page relies on are still the browser's native implementations. Overridden fetch, WebRTC or Function.prototype.toString means an extension, userscript or anti-fraud tool is intercepting the runtime — and every result on this page becomes suspect.

The Payment Request API reveals whether the browser can complete a card payment at all. On Chrome, calling canMakePayment() twice in a row fails with NotAllowedError in incognito windows — a quiet private-mode tell.

ApplePaySession only exists in Safari on Apple devices, so its mere presence is a strong platform signal; canMakePayments() goes further and reveals whether a card is enrolled.

Most wallet extensions inject a global object into every page (window.ethereum, window.solana, ...). Reading which globals exist enumerates your installed wallets — and out you as a crypto user.

EIP-6963 lets wallets announce themselves via window events instead of fighting over window.ethereum. Asking for announcements lists every compliant wallet by name and reverse-DNS id.

Popular extensions leave traces in the page: Grammarly and password managers annotate the DOM, React/Vue devtools install global hooks. Observing those traces reveals which extensions you run.

Ad blockers hide elements whose class names look like ads. Planting a fake 300x250 ad unit and checking whether it gets styled away reveals whether a content blocker is active.

Desktop antivirus and security suites inject marker elements and globals into every page to hook banking protection and link scanning. Those markers quietly reveal which security product guards your machine.

Extensions that modify the page often leave chrome-extension:// URLs in text nodes or attributes. Walking the DOM for those URLs reveals active extensions with no hardcoded target list.

An RTCPeerConnection with no ICE servers still reveals your local network addresses as host candidates. Nothing is sent anywhere — yet your LAN layout, and sometimes a public IP, leaks to any page.

With a STUN server (stun.l.google.com — contacted only if you run this probe), WebRTC learns the public IP your NAT presents to the world. If that differs from your VPN's IP, the tunnel is leaking.

Cloudflare's speed test endpoint reports how the network sees you: public IP, ASN and organization, the edge datacenter you hit and your approximate location. This probe contacts speed.cloudflare.com.

Resolving a random test.nextdns.io hostname reveals whether your DNS resolver is NextDNS, along with the profile id — a glimpse into how your DNS is filtered. This probe contacts test.nextdns.io.

ipinfo.io answers with the public IP it sees plus a geolocation guess and the owning organization — a second, independent opinion to compare against Cloudflare's. This probe contacts ipinfo.io.

Probes your own machine for common dev-service ports (dev servers, Ollama, Docker, MongoDB) by fetching 127.0.0.1 — a reachable port resolves the fetch, a closed one fails fast. Expect failed-request noise in the console while it runs.

Fetches known web-accessible assets of popular extensions — a successful load proves the extension is installed. Chrome/Edge only, and every miss logs a console error, so expect noise in devtools.

Probes a 6,000-entry dictionary of known extension resources — the industrial-scale version of extension detection. Takes up to a minute, fires thousands of requests, and logs console errors for every miss. Chromium only.