Want to know what information I can get about you from your browser and IP address? People don't take internet privacy very seriously. Most people think, “I have nothing to hide.” The problem is they don't understand how this information is being used against you. It is not to monitor your activities looking for illegal actions. You are being tracked so that you can be manipulated on a deep psychological level.
Your composite ID
Survives cookie clearing
computing…
A browser composite ID is a unique tracking identifier formed by combining multiple distinct data points or identifiers. It merges separate tracking data points into a SHA-256 hash that then gets reduced to 64 hex characters to identify a specific user or browser session across a website. Data points tracked are GPU model, user agent, screen resolution, device pixel ratio, CPU cores, device memory, timezone, languages, how many fonts are installed, canvas render, audio fingerprint, camera / microphone counts. This value is not stored, it is calculated on every visit and the same machine produces the same twelve answers, so it produces the same hash. That's the trick: identity without storage!
Privacy score
0
Exposed
out of 100
A stock browser with no additions. This is where most people are, and it is not a failing — nothing here was your decision, it was the default.
Naive entropy
0
bits
Overstated on purpose, and here is the correction: it sums each signal as if they were independent, and they are not. The honest figure is closer to 18–20 bits — one in a quarter of a million, not one in a trillion.
Things I know about you
0
probing…
Reading your machine — read from network headers, hardware probes, your location block and the trackers this page loaded.
Internet
Before this page rendered, before any script ran, your browser volunteered all of this just by asking for the page. Turning off JavaScript does not prevent it. There is no setting that prevents it.
The raw headers your browser sent
0 rows
Equipment
Now JavaScript is running. It measured your machine — not by asking permission, but by drawing shapes, playing a silent tone and timing how long your hardware took. Every answer is boring on its own. Together they are the composite ID at the top of this page.
Loading this map told the tile server your IP address too. I could have hosted the tiles myself. Most sites don't, and neither did I.
Social
Everything above described your machine. This describes your file — who is holding a number that means you, and what left this page while you were reading it.
Sitting on your disk
Security
0/100 · Exposed
Eight checks, all measured by probes that already ran. Three are worth 25 points, five are worth 5, and together they come to 100. Nothing is inferred — if a probe cannot run, the check is skipped rather than assumed.
View:
✕Content blocker refusing requests−25
✕VPN or proxy masking IP address−25
✕Privacy-respecting browser−25
!Canvas fingerprint blocked−5
!Third-party cookies blocked−5
!GPU model masked−5
!Low fingerprint entropy−5
!Clean permission grants−5
Do Not Track
not setworth 0 points
A request with no enforcement behind it, honoured by almost nobody, and abandoned by the standards body that wrote it. It is here because it is the clearest example on the page of a setting people believe is protecting them.
What I can't see
Before the advice, the limits of my own scare story. Four things this page cannot do, and people regularly think it can.
Your browsing history
The CSS trick that leaked visited links was closed in 2010. There is no replacement.
Other sites' cookies
Same-origin policy is real and it holds. I see cookies set on this domain, and nothing else.
Your files, or your name
No filesystem access, no address book, no identity — unless you type it into a form.
Turn on your camera silently
The prompt is not decoration. It is why two buttons on this page did nothing until you pressed them.
And yet
Meta and Google do not need your history, because they are on the sites where you make it. The identifiers above are the same ones on a few million other pages. Nobody had to break the rules — they just had to be present everywhere, which they are.
Recommendations
8 cards for you
One card for each check you did not pass, worth exactly the points you did not earn, ordered by how much of your score it returns — not by what it costs.
The canvas and WebGL measurements become randomised per site and per session, which breaks the composite ID into a different ID everywhere.
Doesn't fix
Randomisation is itself unusual. Very few people do it, so in a small way it makes you rarer while making you unlinkable.
Block third-party cookies
Free · a browser setting
+5
of 100
Fixes
The Meta and Google identifiers in Social stop following you between sites.
Doesn't fix
First-party tracking, server-side tagging, and the fingerprint — all of which exist precisely because this setting became common.
Disable WebGL on sites that don’t need it
Free · extension or browser flag
+5
of 100
Fixes
Removes the single most distinctive string in this report — your exact GPU model — and everything derived from it.
Doesn't fix
Breaks maps, games and some video players. This one has a real cost and I would not blame you for skipping it.
Look ordinary
Free · and the hardest thing on this list
+5
of 100
Fixes
Default window size, default fonts, default language, no exotic extensions. Fingerprinting works on rarity, so being boring is the whole defence.
Doesn't fix
Almost nobody sustains it, and the Tor Browser is the only thing that enforces it for you. Treat this as context rather than a task.
Revoke stale permissions
Free · site settings, five minutes
+5
of 100
Fixes
Old camera, microphone and location grants from sites you visited once and forgot. They do not expire on their own.
Doesn't fix
Anything about this visit. It is housekeeping, which is why it is last and worth the fewest points.
Take the report with you
Everything above, as a file you can keep.
There is an obvious joke here and I will make it explicitly rather than let you notice it later: this is a form, on a privacy page, asking for three things I could not otherwise learn about you. Everything above was taken. This is the part you get to decline — the report downloads either way.
Social
Everything above described your machine. This describes your file — who is holding a number that means you, and what left this page while you were reading it.