What Does Your Browser Reveal About You?
Your IP address is the identifier people worry about. It is also the one that is easiest to change, and far from the most revealing thing your browser hands over. Every request carries a small dossier about your device, and a few lines of JavaScript can extend that into something close to a unique signature.
None of this requires a cookie. Clearing your history does not touch it.
What goes out before any JavaScript runs?
HTTP headers, sent with every single request. The interesting ones are few.
| Header | What it carries |
|---|---|
| User-Agent | Browser, version, operating system and often the rendering engine. Increasingly frozen or reduced by browsers, but still the first thing most sites read. |
| Accept-Language | The languages you configured, in order of preference. Frequently a strong hint about where you are and where you are from, which are not always the same place. |
| Accept-Encoding | Which compression formats you support. Dull on its own, mildly distinguishing in combination. |
| Referer | The page you came from, if the site that linked you allows it to be sent. |
| Sec-CH-UA family | Client hints: a newer, more granular replacement for the user agent that sites must explicitly request. |
You can read your own with the HTTP headers viewer, which shows them exactly as our server received them.
What does JavaScript add?
A great deal more. Screen dimensions and colour depth. Time zone, which often contradicts a VPN exit and gives the game away. Installed fonts, inferred by measuring text. The number of CPU cores and a rough memory figure. Touch support. How your graphics hardware renders a test image, which varies enough between GPU and driver combinations to be useful on its own.
No single one identifies you. Together they frequently do, and that is the point of fingerprinting: not to learn your name, but to recognise the same visitor across sessions without storing anything on your machine.
How unique is a fingerprint, really?
It depends heavily on how ordinary your setup is. A current iPhone running Safari with default settings looks like an enormous number of other current iPhones, which is a genuine privacy advantage. A Linux desktop with an unusual screen size, a niche font set and three extensions installed may well be unique among everyone who visits a given site.
There is an uncomfortable twist here. Many anti-fingerprinting extensions make you more identifiable rather than less, because a browser reporting implausible or contradictory values stands out sharply against the crowd. Blending in beats hiding.
What does a VPN actually hide?
Your IP address, and the contents of your traffic from anyone on the local network. That is the list.
It does not change your user agent, your language preferences, your screen size, your fonts or your time zone. A connection claiming to originate in Frankfurt while the browser reports Asia/Kolkata and prefers Hindi is a contradiction that any site bothering to look will notice. Worse, your browser may leak the real address directly through WebRTC regardless of the tunnel, which is a specific enough problem to deserve its own explanation and its own test.
What can you reasonably do?
- Use a mainstream browser with defaults. Safari and Firefox both ship meaningful fingerprinting resistance now, and looking like everyone else is the strongest position available.
- Keep extensions few. Each one is a potential signal, and the combination is more distinguishing than any single addition.
- Match your time zone to your VPN exit if you are using one seriously. The mismatch is one of the easiest tells to spot.
- Use the browser's private window for genuinely separate sessions, remembering it isolates storage, not your fingerprint.
- Accept the tradeoff. Total resistance breaks a lot of the web. Most people want to be unremarkable rather than invisible.
Seeing your own
The browser info page shows what your browser exposes to any site you visit: user agent, screen, language, time zone and the rest, with nothing stored. Pair it with the HTTP headers viewer for the pre-JavaScript layer, and the WebRTC leak test if you are behind a VPN and want to know whether it is holding.
Try it yourself
See the real numbers for your own connection with our free tools.